On Wed Jul 29 11:18:34 2026 +0900, Myeonghun Pak wrote:
> stm32_csi_parse_dt() registers the async notifier before probe finishes.
> If a later operation fails, the error path only cleans up the notifier's
> connections. It does not unregister the notifier, leaving its entry on
> the global notifier list after the devm-allocated csidev is freed.
>
> The remove path has the same problem. A later async operation can then
> walk the stale notifier entry and access freed memory.
>
> Unregister the notifier before cleaning up its resources on both paths.
>
> Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
> Cc: [email protected]
> Co-developed-by: Ijae Kim <[email protected]>
> Signed-off-by: Ijae Kim <[email protected]>
> Signed-off-by: Myeonghun Pak <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/st/stm32/stm32-csi.c | 3 +++
1 file changed, 3 insertions(+)
---
diff --git a/drivers/media/platform/st/stm32/stm32-csi.c
b/drivers/media/platform/st/stm32/stm32-csi.c
index ecd0ed8e76b5..78c68cf90ffc 100644
--- a/drivers/media/platform/st/stm32/stm32-csi.c
+++ b/drivers/media/platform/st/stm32/stm32-csi.c
@@ -1059,6 +1059,7 @@ static int stm32_csi_probe(struct platform_device *pdev)
return 0;
err_cleanup:
+ v4l2_async_nf_unregister(&csidev->notifier);
v4l2_async_nf_cleanup(&csidev->notifier);
return ret;
}
@@ -1067,6 +1068,8 @@ static void stm32_csi_remove(struct platform_device *pdev)
{
struct stm32_csi_dev *csidev = platform_get_drvdata(pdev);
+ v4l2_async_nf_unregister(&csidev->notifier);
+ v4l2_async_nf_cleanup(&csidev->notifier);
v4l2_async_unregister_subdev(&csidev->sd);
pm_runtime_disable(&pdev->dev);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
