On Thu Jul 30 17:37:54 2026 +0700, Cong Nguyen wrote:
> isys_register_devices() registers the V4L2 async notifier via
> isys_notifier_init(). If a subsequent probe step such as
> isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label
> which only calls isys_unregister_devices(). That helper tears down the
> video devices, subdevices, V4L2 device and media device, but never
> unregisters or cleans up the async notifier.
>
> As a result the notifier stays chained in the global notifier_list while
> the enclosing struct ipu7_isys is freed by devres, leading to list
> corruption and a use-after-free the next time the list is walked.
>
> The remove path already does the right thing by calling
> isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on
> the probe error path so the notifier is unregistered and cleaned up
> before the device is torn down.
>
> Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device
> driver")
> Cc: [email protected]
> Signed-off-by: Cong Nguyen <[email protected]>
> Signed-off-by: Sakari Ailus <[email protected]>
Patch committed.
Thanks,
Sakari Ailus
drivers/staging/media/ipu7/ipu7-isys.c | 1 +
1 file changed, 1 insertion(+)
---
diff --git a/drivers/staging/media/ipu7/ipu7-isys.c
b/drivers/staging/media/ipu7/ipu7-isys.c
index c626de051898..601e5a79ef8e 100644
--- a/drivers/staging/media/ipu7/ipu7-isys.c
+++ b/drivers/staging/media/ipu7/ipu7-isys.c
@@ -774,6 +774,7 @@ static int isys_probe(struct auxiliary_device *auxdev,
return 0;
out_cleanup:
+ isys_notifier_cleanup(isys);
isys_unregister_devices(isys);
out_cleanup_fw:
ipu7_fw_isys_release(isys);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
