[PATCH] media: i2c: tda1997x: Fix potential use-after-free on probe failure

[Guangshuo Li]

If audio component registration or IRQ setup fails after the subdevice
has been registered, probe frees state without unregistering it. A bound
notifier can then retain a pointer into freed state and dereference it
during teardown.

Unregister the subdevice on these late probe failures before cleaning up
the media entity and freeing state.

This issue was found by our static analysis tool under development.

Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Build-tested drivers/media/i2c/tda1997x.o with x86_64 allmodconfig
(GCC 13.3, W=1). Rechecked the probe unwind paths in source.
No hardware runtime or fault-injection testing was performed.

 drivers/media/i2c/tda1997x.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index 30dfd8a7b42b..4ff9acbc005e 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -2776,7 +2776,7 @@ static int tda1997x_probe(struct i2c_client *client)
 					     &tda1997x_audio_dai, 1);
 		if (ret) {
 			dev_err(&client->dev, "register audio codec failed\n");
-			goto err_free_media;
+			goto err_unreg_subdev;
 		}
 		v4l_info(state->client, "registered audio codec\n");
 	}
@@ -2788,11 +2788,13 @@ static int tda1997x_probe(struct i2c_client *client)
 					KBUILD_MODNAME, state);
 	if (ret) {
 		v4l_err(client, "irq%d reg failed: %d\n", client->irq, ret);
-		goto err_free_media;
+		goto err_unreg_subdev;
 	}
 
 	return 0;
 
+err_unreg_subdev:
+	v4l2_async_unregister_subdev(sd);
 err_free_media:
 	media_entity_cleanup(&sd->entity);
 err_free_handler:

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3