[PATCH] media: stm32: csi: fix async notifier leak and UAF on probe error and remove

[Cong Nguyen]

stm32_csi_parse_dt() registers the V4L2 async notifier with
v4l2_async_nf_register(). Two teardown paths fail to undo this:

  - The probe error label err_cleanup is only reached after
    stm32_csi_parse_dt() has succeeded (and thus registered the
    notifier), but it calls only v4l2_async_nf_cleanup(), never
    v4l2_async_nf_unregister().

  - stm32_csi_remove() unregisters the subdev but never unregisters or
    cleans up the notifier at all.

In both cases the notifier stays chained in the global notifier_list
while the enclosing struct stm32_csi_dev is freed by devres, leading to
list corruption and a use-after-free when the list is next walked.

Unregister and clean up the notifier on both paths, matching the
required v4l2_async_nf_unregister() + v4l2_async_nf_cleanup() teardown.

Fixes: dcb0f4c16be5 ("media: stm32: csi: addition of the STM32 CSI driver")
Cc: stable at vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264 at gmail.com>
---
 drivers/media/platform/st/stm32/stm32-csi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c
index fd2b6dfbd44c..65800aacf28d 100644
--- a/drivers/media/platform/st/stm32/stm32-csi.c
+++ b/drivers/media/platform/st/stm32/stm32-csi.c
@@ -1059,6 +1059,7 @@ static int stm32_csi_probe(struct platform_device *pdev)
 	return 0;
 
 err_cleanup:
+	v4l2_async_nf_unregister(&csidev->notifier);
 	v4l2_async_nf_cleanup(&csidev->notifier);
 	return ret;
 }
@@ -1069,6 +1070,9 @@ static void stm32_csi_remove(struct platform_device *pdev)
 
 	v4l2_async_unregister_subdev(&csidev->sd);
 
+	v4l2_async_nf_unregister(&csidev->notifier);
+	v4l2_async_nf_cleanup(&csidev->notifier);
+
 	pm_runtime_disable(&pdev->dev);
 }
 
-- 
2.25.1