5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Yadav p.yadav@ti.com
[ Upstream commit b2701715301a49b53d05c7d43f3fedc3b8743bfc ]
The notifier is added to the global notifier list when registered. When the module is removed, the struct csi2rx_priv in which the notifier is embedded, is destroyed. As a result the notifier list has a reference to a notifier that no longer exists. This causes invalid memory accesses when the list is iterated over. Similar for when the probe fails. Unregister and clean up the notifier to avoid this.
Fixes: 1fc3b37f34f6 ("media: v4l: cadence: Add Cadence MIPI-CSI2 RX driver")
Signed-off-by: Pratyush Yadav p.yadav@ti.com Tested-by: Julien Massot julien.massot@collabora.com Reviewed-by: Laurent Pinchart laurent.pinchart@ideasonboard.com Reviewed-by: Tomi Valkeinen tomi.valkeinen@ideasonboard.com Reviewed-by: Maxime Ripard mripard@kernel.org Signed-off-by: Jai Luthra j-luthra@ti.com Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Hans Verkuil hverkuil-cisco@xs4all.nl Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/media/platform/cadence/cdns-csi2rx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/media/platform/cadence/cdns-csi2rx.c +++ b/drivers/media/platform/cadence/cdns-csi2rx.c @@ -407,8 +407,10 @@ static int csi2rx_parse_dt(struct csi2rx fwh, struct v4l2_async_subdev); of_node_put(ep); - if (IS_ERR(asd)) + if (IS_ERR(asd)) { + v4l2_async_notifier_cleanup(&csi2rx->notifier); return PTR_ERR(asd); + }
csi2rx->notifier.ops = &csi2rx_notifier_ops;
@@ -471,6 +473,7 @@ static int csi2rx_probe(struct platform_ return 0;
err_cleanup: + v4l2_async_notifier_unregister(&csi2rx->notifier); v4l2_async_notifier_cleanup(&csi2rx->notifier); err_free_priv: kfree(csi2rx); @@ -481,6 +484,8 @@ static int csi2rx_remove(struct platform { struct csi2rx_priv *csi2rx = platform_get_drvdata(pdev);
+ v4l2_async_notifier_unregister(&csi2rx->notifier); + v4l2_async_notifier_cleanup(&csi2rx->notifier); v4l2_async_unregister_subdev(&csi2rx->subdev); kfree(csi2rx);