From 3de6ee94aae701fa949cd3b5df6b6a440ddfb8f2 Mon Sep 17 00:00:00 2001 From: Sebastian Reichel Date: Mon, 13 Nov 2023 23:57:23 +0100 Subject: media: v4l: async: Fix duplicated list deletion The list deletion call dropped here is already called from the helper function in the line before. Having a second list_del() call results in either a warning (with CONFIG_DEBUG_LIST=y): list_del corruption, c46c8198->next is LIST_POISON1 (00000100) If CONFIG_DEBUG_LIST is disabled the operation results in a kernel error due to NULL pointer dereference. Fixes: 28a1295795d8 ("media: v4l: async: Allow multiple connections between entities") Signed-off-by: Sebastian Reichel Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil --- drivers/media/v4l2-core/v4l2-async.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers/media/v4l2-core/v4l2-async.c') diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c index 091e8cf4114b..8cfd593d293d 100644 --- a/drivers/media/v4l2-core/v4l2-async.c +++ b/drivers/media/v4l2-core/v4l2-async.c @@ -880,7 +880,6 @@ void v4l2_async_unregister_subdev(struct v4l2_subdev *sd) &asc->notifier->waiting_list); v4l2_async_unbind_subdev_one(asc->notifier, asc); - list_del(&asc->asc_subdev_entry); } } -- cgit v1.2.3 From bec3db03911bd85da29c1c8ee556162153002c9a Mon Sep 17 00:00:00 2001 From: Sebastian Reichel Date: Mon, 13 Nov 2023 23:57:24 +0100 Subject: media: v4l: async: Drop useless list move operation v4l2_async_unbind_subdev_one(), which is called in the line following the list_move() operation contains list_move_tail() for the same entry and overrides anything list_move() did. Thus it can be removed. Signed-off-by: Sebastian Reichel Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil --- drivers/media/v4l2-core/v4l2-async.c | 3 --- 1 file changed, 3 deletions(-) (limited to 'drivers/media/v4l2-core/v4l2-async.c') diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c index 8cfd593d293d..3ec323bd528b 100644 --- a/drivers/media/v4l2-core/v4l2-async.c +++ b/drivers/media/v4l2-core/v4l2-async.c @@ -876,9 +876,6 @@ void v4l2_async_unregister_subdev(struct v4l2_subdev *sd) if (sd->asc_list.next) { list_for_each_entry_safe(asc, asc_tmp, &sd->asc_list, asc_subdev_entry) { - list_move(&asc->asc_entry, - &asc->notifier->waiting_list); - v4l2_async_unbind_subdev_one(asc->notifier, asc); } } -- cgit v1.2.3