On Tue Sep 15 16:26:38 2026 +0800, Runyu Xiao wrote:
> The VPP ancillary-client error path unregisters the CSI client before
> destroying state->mutex. For I2P variants, the failure can occur before
> mutex_init(), so cleanup destroys an uninitialized mutex.
>
> Initialize the mutex immediately after allocating the driver state, before
> creating any ancillary clients. This keeps every cleanup path matched with
> a completed mutex initialization.
>
> A QEMU x86_64 test using an i2c-stub bus instantiated an ADV7280 client
> at address 0x21 and occupied its VPP ancillary address 0x42. This forced
> i2c_new_ancillary_device() to return -EBUSY. An instrumentation oracle
> observed an uninitialized mutex on the buggy kernel and an initialized
> mutex on the fixed kernel. The failure was deliberately injected to
> exercise the error path; no natural crash was observed.
>
> Fixes: 851a54effbd8 ("[media] adv7180: Add I2P support")
> Cc: [email protected]
> Assisted-by: LLM Codex
> Signed-off-by: Runyu Xiao <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/i2c/adv7180.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
index 5951da285b6f..02197f813758 100644
--- a/drivers/media/i2c/adv7180.c
+++ b/drivers/media/i2c/adv7180.c
@@ -1455,6 +1455,7 @@ static int adv7180_probe(struct i2c_client *client)
if (state == NULL)
return -ENOMEM;
+ mutex_init(&state->mutex);
state->client = client;
state->field = V4L2_FIELD_ALTERNATE;
state->chip_info = i2c_get_match_data(client);
@@ -1498,7 +1499,6 @@ static int adv7180_probe(struct i2c_client *client)
}
state->irq = client->irq;
- mutex_init(&state->mutex);
state->curr_norm = V4L2_STD_NTSC;
state->input = 0;
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
