7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Runyu Xiao [ Upstream commit 9d46d17a65e86010b1f5604e5cf61ce1e197f77a ] The VPP ancillary-client error path unregisters the CSI client before destroying state->mutex. For I2P variants, the failure can occur before mutex_init(), so cleanup destroys an uninitialized mutex. Initialize the mutex immediately after allocating the driver state, before creating any ancillary clients. This keeps every cleanup path matched with a completed mutex initialization. A QEMU x86_64 test using an i2c-stub bus instantiated an ADV7280 client at address 0x21 and occupied its VPP ancillary address 0x42. This forced i2c_new_ancillary_device() to return -EBUSY. An instrumentation oracle observed an uninitialized mutex on the buggy kernel and an initialized mutex on the fixed kernel. The failure was deliberately injected to exercise the error path; no natural crash was observed. Fixes: 851a54effbd8 ("[media] adv7180: Add I2P support") Cc: stable@vger.kernel.org Assisted-by: LLM Codex Signed-off-by: Runyu Xiao Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/i2c/adv7180.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c index a1c7f68225b45..8c2cf3f539781 100644 --- a/drivers/media/i2c/adv7180.c +++ b/drivers/media/i2c/adv7180.c @@ -1454,6 +1454,7 @@ static int adv7180_probe(struct i2c_client *client) if (state == NULL) return -ENOMEM; + mutex_init(&state->mutex); state->client = client; state->field = V4L2_FIELD_ALTERNATE; state->chip_info = i2c_get_match_data(client); @@ -1497,7 +1498,6 @@ static int adv7180_probe(struct i2c_client *client) } state->irq = client->irq; - mutex_init(&state->mutex); state->curr_norm = V4L2_STD_NTSC; state->input = 0; -- 2.53.0