[PATCH] media: v4l2: Clear subdev devnode before calling release()

[David Heidelberg via B4 Relay]

From: David Heidelberg <david@xxxxxxx>

The subdevice release callback frees the memory that contains the
v4l2_subdev structure itself, but v4l2_subdev_release() wrote
sd->devnode = NULL after invoking the callback. Any driver implementing
the release callback to free its state would leave that write targeting
already-freed memory.

Clear sd->devnode before calling the release callback so the callback
runs last, matching its documented purpose of freeing the subdevice
memory.

Fixes: 6990570f7e0a ("media: v4l2-core: fix a use-after-free bug of sd->devnode")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: David Heidelberg <david@xxxxxxx>
---
 drivers/media/v4l2-core/v4l2-device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-device.c b/drivers/media/v4l2-core/v4l2-device.c
index 67e3073de1321..b4036105c2d1a 100644
--- a/drivers/media/v4l2-core/v4l2-device.c
+++ b/drivers/media/v4l2-core/v4l2-device.c
@@ -171,19 +171,19 @@ int __v4l2_device_register_subdev(struct v4l2_device *v4l2_dev,
 	return err;
 }
 EXPORT_SYMBOL_GPL(__v4l2_device_register_subdev);
 
 static void v4l2_subdev_release(struct v4l2_subdev *sd)
 {
 	struct module *owner = !sd->owner_v4l2_dev ? sd->owner : NULL;
 
+	sd->devnode = NULL;
 	if (sd->internal_ops && sd->internal_ops->release)
 		sd->internal_ops->release(sd);
-	sd->devnode = NULL;
 	module_put(owner);
 }
 
 static void v4l2_device_release_subdev_node(struct video_device *vdev)
 {
 	v4l2_subdev_release(video_get_drvdata(vdev));
 	kfree(vdev);
 }

---
base-commit: 7079a12d7506b07fb53b54a664bfad5fa9b16d70
change-id: 20260917-v4l2-release-fix-89094967bc9d

Best regards,
--  
David Heidelberg <david@xxxxxxx>