From: Sebastian Reichel <sre@kernel.org>
To: Sebastian Reichel <sre@kernel.org>,
Sakari Ailus <sakari.ailus@linux.intel.com>,
Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Cc: Alain Volmat <alain.volmat@foss.st.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Rob Herring <robh+dt@kernel.org>,
Krzysztof Kozlowski <krzysztof.kozlowski+dt@linaro.org>,
Conor Dooley <conor+dt@kernel.org>,
linux-media@vger.kernel.org, devicetree@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH v4 4/6] media: v4l: async: Fix duplicated list deletion
Date: Mon, 13 Nov 2023 23:57:23 +0100 [thread overview]
Message-ID: <20231113230421.226808-5-sre@kernel.org> (raw)
In-Reply-To: <20231113230421.226808-1-sre@kernel.org>
The list deletion call dropped here is already called from the
helper function in the line before. Having a second list_del()
call results in either a warning (with CONFIG_DEBUG_LIST=y):
list_del corruption, c46c8198->next is LIST_POISON1 (00000100)
If CONFIG_DEBUG_LIST is disabled the operation results in a
kernel error due to NULL pointer dereference.
Fixes: 28a1295795d8 ("media: v4l: async: Allow multiple connections between entities")
Signed-off-by: Sebastian Reichel <sre@kernel.org>
---
drivers/media/v4l2-core/v4l2-async.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
index 091e8cf4114b..8cfd593d293d 100644
--- a/drivers/media/v4l2-core/v4l2-async.c
+++ b/drivers/media/v4l2-core/v4l2-async.c
@@ -880,7 +880,6 @@ void v4l2_async_unregister_subdev(struct v4l2_subdev *sd)
&asc->notifier->waiting_list);
v4l2_async_unbind_subdev_one(asc->notifier, asc);
- list_del(&asc->asc_subdev_entry);
}
}
--
2.42.0
next prev parent reply other threads:[~2023-11-13 23:04 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-13 22:57 [PATCH v4 0/6] GC0308 Camera Sensor Sebastian Reichel
2023-11-13 22:57 ` [PATCH v4 1/6] dt-bindings: vendor-prefixes: add GalaxyCore Sebastian Reichel
2023-11-13 22:57 ` [PATCH v4 2/6] media: dt-bindings: gc0308: add binding Sebastian Reichel
2023-11-13 22:57 ` [PATCH v4 3/6] media: MAINTAINERS: Add GalaxyCore in camera sensor section Sebastian Reichel
2023-11-13 22:57 ` Sebastian Reichel [this message]
2023-11-13 22:57 ` [PATCH v4 5/6] media: v4l: async: Drop useless list move operation Sebastian Reichel
2023-11-13 22:57 ` [PATCH v4 6/6] media: i2c: gc0308: new driver Sebastian Reichel
2023-11-24 15:22 ` Tommaso Merciai
2023-11-24 11:24 ` [PATCH v4 0/6] GC0308 Camera Sensor Sakari Ailus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231113230421.226808-5-sre@kernel.org \
--to=sre@kernel.org \
--cc=alain.volmat@foss.st.com \
--cc=conor+dt@kernel.org \
--cc=devicetree@vger.kernel.org \
--cc=jacopo.mondi@ideasonboard.com \
--cc=krzysztof.kozlowski+dt@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=robh+dt@kernel.org \
--cc=sakari.ailus@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.