media: v4l: async: Properly re-initialise notifier entry in unregister

[Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>]

From: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>

commit 9537a8425a7a0222999d5839a0b394b1e8834b4a upstream.

The notifier_entry of a notifier is not re-initialised after unregistering
the notifier. This leads to dangling pointers being left there so use
list_del_init() to return the notifier_entry an empty list.

Fixes: b8ec754ae4c5 ("media: v4l: async: Set v4l2_device and subdev in async notifier init")
Cc: <stable@xxxxxxxxxxxxxxx> # for 6.6 and later
Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/media/v4l2-core/v4l2-async.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -639,7 +639,7 @@ __v4l2_async_nf_unregister(struct v4l2_a
 
 	v4l2_async_nf_unbind_all_subdevs(notifier);
 
-	list_del(&notifier->notifier_entry);
+	list_del_init(&notifier->notifier_entry);
 }
 
 void v4l2_async_nf_unregister(struct v4l2_async_notifier *notifier)


Patches currently in stable-queue which might be from sakari.ailus@xxxxxxxxxxxxxxx are

queue-6.9/media-mc-fix-graph-walk-in-media_pipeline_start.patch
queue-6.9/media-ov2740-fix-link_freq-and-pixel_rate-control-value-reporting.patch
queue-6.9/media-v4l-async-fix-notifier-list-entry-init.patch
queue-6.9/media-v4l-async-don-t-set-notifier-s-v4l2-device-if-registering-fails.patch
queue-6.9/media-mc-mark-the-media-devnode-as-registered-from-the-start.patch
queue-6.9/media-v4l-async-properly-re-initialise-notifier-entry-in-unregister.patch
queue-6.9/media-v4l2-core-hold-videodev_lock-until-dev-reg-finishes.patch