Patch "media: cadence: csi2rx: Unregister v4l2 async notifier" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    media: cadence: csi2rx: Unregister v4l2 async notifier

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-cadence-csi2rx-unregister-v4l2-async-notifier.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3ac4667d6c72e2927cb3a9ed1b9a963481b47e76
Author: Pratyush Yadav <p.yadav@xxxxxx>
Date:   Mon Oct 9 18:39:29 2023 +0530

    media: cadence: csi2rx: Unregister v4l2 async notifier
    
    [ Upstream commit b2701715301a49b53d05c7d43f3fedc3b8743bfc ]
    
    The notifier is added to the global notifier list when registered. When
    the module is removed, the struct csi2rx_priv in which the notifier is
    embedded, is destroyed. As a result the notifier list has a reference to
    a notifier that no longer exists. This causes invalid memory accesses
    when the list is iterated over. Similar for when the probe fails.
    Unregister and clean up the notifier to avoid this.
    
    Fixes: 1fc3b37f34f6 ("media: v4l: cadence: Add Cadence MIPI-CSI2 RX driver")
    
    Signed-off-by: Pratyush Yadav <p.yadav@xxxxxx>
    Tested-by: Julien Massot <julien.massot@xxxxxxxxxxxxx>
    Reviewed-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
    Reviewed-by: Tomi Valkeinen <tomi.valkeinen@xxxxxxxxxxxxxxxx>
    Reviewed-by: Maxime Ripard <mripard@xxxxxxxxxx>
    Signed-off-by: Jai Luthra <j-luthra@xxxxxx>
    Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c
index 7b44ab2b8c9ad..292044588ae2c 100644
--- a/drivers/media/platform/cadence/cdns-csi2rx.c
+++ b/drivers/media/platform/cadence/cdns-csi2rx.c
@@ -406,8 +406,10 @@ static int csi2rx_parse_dt(struct csi2rx_priv *csi2rx)
 	asd = v4l2_async_nf_add_fwnode_remote(&csi2rx->notifier, fwh,
 					      struct v4l2_async_subdev);
 	of_node_put(ep);
-	if (IS_ERR(asd))
+	if (IS_ERR(asd)) {
+		v4l2_async_nf_cleanup(&csi2rx->notifier);
 		return PTR_ERR(asd);
+	}
 
 	csi2rx->notifier.ops = &csi2rx_notifier_ops;
 
@@ -469,6 +471,7 @@ static int csi2rx_probe(struct platform_device *pdev)
 	return 0;
 
 err_cleanup:
+	v4l2_async_nf_unregister(&csi2rx->notifier);
 	v4l2_async_nf_cleanup(&csi2rx->notifier);
 err_free_priv:
 	kfree(csi2rx);
@@ -479,6 +482,8 @@ static int csi2rx_remove(struct platform_device *pdev)
 {
 	struct csi2rx_priv *csi2rx = platform_get_drvdata(pdev);
 
+	v4l2_async_nf_unregister(&csi2rx->notifier);
+	v4l2_async_nf_cleanup(&csi2rx->notifier);
 	v4l2_async_unregister_subdev(&csi2rx->subdev);
 	kfree(csi2rx);
 



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux