[PATCH] media: stm32-dcmi: fix async notifier leak on probe error path

[Cong Nguyen]

dcmi_graph_init() registers the V4L2 async notifier with
v4l2_async_nf_register(). The probe error label err_cleanup is reached
after dcmi_graph_init() has already succeeded (e.g. when the subsequent
reset_control_assert()/deassert() fails), but it calls only
v4l2_async_nf_cleanup() and never v4l2_async_nf_unregister().

The notifier therefore remains chained in the global notifier_list while
the enclosing struct stm32_dcmi is freed, leading to list corruption and
a use-after-free when the list is next walked.

Unregister the notifier before cleaning it up on the error path, matching
the teardown already done in dcmi_remove().

Fixes: d079f94c9046 ("media: platform: Switch to v4l2_async_notifier_add_subdev")
Cc: stable at vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264 at gmail.com>
---
 drivers/media/platform/st/stm32/stm32-dcmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/st/stm32/stm32-dcmi.c b/drivers/media/platform/st/stm32/stm32-dcmi.c
index e5663fbe6422..eeb0199864dd 100644
--- a/drivers/media/platform/st/stm32/stm32-dcmi.c
+++ b/drivers/media/platform/st/stm32/stm32-dcmi.c
@@ -2195,6 +2195,7 @@ static int dcmi_probe(struct platform_device *pdev)
 	return 0;
 
 err_cleanup:
+	v4l2_async_nf_unregister(&dcmi->notifier);
 	v4l2_async_nf_cleanup(&dcmi->notifier);
 err_media_entity_cleanup:
 	media_entity_cleanup(&dcmi->vdev->entity);
-- 
2.25.1