Commit cc10774e authored by Sakari Ailus's avatar Sakari Ailus Committed by Cheng Yu
Browse files

media: v4l: async: Properly re-initialise notifier entry in unregister 

mainline inclusion
from mainline-v6.10-rc1
commit 9537a8425a7a0222999d5839a0b394b1e8834b4a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB05K
CVE: CVE-2024-39485

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9537a8425a7a0222999d5839a0b394b1e8834b4a



--------------------------------

The notifier_entry of a notifier is not re-initialised after unregistering
the notifier. This leads to dangling pointers being left there so use
list_del_init() to return the notifier_entry an empty list.

Fixes: b8ec754a ("media: v4l: async: Set v4l2_device and subdev in async notifier init")
Cc: <stable@vger.kernel.org> # for 6.6 and later
Signed-off-by: default avatarSakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarCheng Yu <serein.chengyu@huawei.com>
parent de51c3bc

drivers/media/v4l2-core/v4l2-async.c

+1 −1
Original line number Diff line number Diff line
@@ -639,7 +639,7 @@ __v4l2_async_nf_unregister(struct v4l2_async_notifier *notifier) 


	v4l2_async_nf_unbind_all_subdevs(notifier);



	list_del(&notifier->notifier_entry);

	list_del_init(&notifier->notifier_entry);

}



void v4l2_async_nf_unregister(struct v4l2_async_notifier *notifier)