diff options
| author | Xu Rao <raoxu@uniontech.com> | 2026-08-10 17:50:12 +0800 |
|---|---|---|
| committer | Sakari Ailus <sakari.ailus@linux.intel.com> | 2026-08-10 14:04:24 +0300 |
| commit | 47d82b605351c0e04f6365e42c8ffe2fcfdba615 (patch) | |
| tree | c7f0986150c6303e6fb4e302bf19a26ccf883db8 | |
| parent | 56c29fa3ee666197516a231e75aed789ae9c530d (diff) | |
media: v4l2-async: avoid deleting unlinked ASC entry on link error
v4l2_async_match_notify() creates ancillary media links before adding
asc->asc_subdev_entry to sd->asc_list.
If ancillary link creation fails, the function jumps to
err_call_unbind while asc_subdev_entry has not been linked yet. Async
connections are zero-allocated, so the list entry still has NULL next
and prev pointers on this path. Calling list_del() on it can therefore
dereference NULL instead of returning the original link creation error.
Do not delete asc_subdev_entry from err_call_unbind. There is no list
insertion to undo on this path; the bound callback and sub-device
registration are the operations that need to be rolled back.
Fixes: 28a1295795d8 ("media: v4l: async: Allow multiple connections between entities")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
| -rw-r--r-- | drivers/media/v4l2-core/v4l2-async.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c index f36d60e6ff41..460bf3dbbb88 100644 --- a/drivers/media/v4l2-core/v4l2-async.c +++ b/drivers/media/v4l2-core/v4l2-async.c @@ -392,7 +392,6 @@ static int v4l2_async_match_notify(struct v4l2_async_notifier *notifier, err_call_unbind: v4l2_async_nf_call_unbind(notifier, sd, asc); - list_del(&asc->asc_subdev_entry); err_unregister_subdev: if (registered) |