Description
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: Fix error handling on steps after finding a match Once an async connection is found to be matching with an fwnode, a sub-device may be registered (in case it wasn't already), its bound operation is called, ancillary links are created, the async connection is added to the sub-device's list of connections and removed from the global waiting connection list. Further on, the sub-device's possible own notifier is searched for possible additional matches. Fix these specific issues: - If v4l2_async_match_notify() failed before the sub-notifier handling, the async connection was unbound and its entry removed from the sub-device's async connection list. The latter part was also done in v4l2_async_match_notify(). - The async connection's sd field was only set after creating ancillary links in v4l2_async_match_notify(). It was however dereferenced in v4l2_async_unbind_subdev_one(), which was called on error path of v4l2_async_match_notify() failure.
Product status
28a1295795d85a25f2e7dd391c43969e95fcb341 (git) before 30aaed311f973f13ba13a0cd2dc0202f595fff48
28a1295795d85a25f2e7dd391c43969e95fcb341 (git) before 461733d83e67ba7e3a5b750c0d203f738e01244f
28a1295795d85a25f2e7dd391c43969e95fcb341 (git) before b02bcb378efa8af07827f49b3afcc5e825318c55
28a1295795d85a25f2e7dd391c43969e95fcb341 (git) before 2de0a3c8148fc3dbea21981e6569f550b3626119
28a1295795d85a25f2e7dd391c43969e95fcb341 (git) before 7345d6d356336c448d6b9230ed8704f39679fd12
6.6
Any version before 6.6
6.6.128 (semver)
6.12.75 (semver)
6.18.16 (semver)
6.19.6 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/30aaed311f973f13ba13a0cd2dc0202f595fff48
git.kernel.org/...c/461733d83e67ba7e3a5b750c0d203f738e01244f
git.kernel.org/...c/b02bcb378efa8af07827f49b3afcc5e825318c55
git.kernel.org/...c/2de0a3c8148fc3dbea21981e6569f550b3626119
git.kernel.org/...c/7345d6d356336c448d6b9230ed8704f39679fd12