From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 016B54508F7 for ; Wed, 8 Jul 2026 12:57:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783515459; cv=none; b=QXhYQUYCJOHEPKULGiCZXZwqXd/P82+9iVJkTZnFUrHBiX6w/m/dJm4s35d6qHLDer1dF0YYaYdC3+AZREAhUqTTiiswU72z+WmRf8GaEbCjw3Fwr8Fhpn4CA/um+7qhdQuaPoKFwWqiprtEWCjjF8qPZbn6vMR73vBuI3Yd3F8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783515459; c=relaxed/simple; bh=UrE93zXjZyxA/Ev+jUp9i7tYXbt2bq4qQ3/zk7AAZ7I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VghC6VOv/MPMxdpDEftiA9lyx+4Jr/yEUmfP8trd4tn5+R79whX+eObG+qMdLsyr6QdEl/J8s2mKoEASQbwg/w9JHwBuxbfj2/3A27wYVKDHyhn2tWa08C6P9JAI5jtl3v7+tuMrdR/uBroT7Vq4qr+czjA3P5jDyVznv7TNa1I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=F2Rt2U9X; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="F2Rt2U9X" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2ca64c3ce5fso7687795ad.3 for ; Wed, 08 Jul 2026 05:57:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783515457; x=1784120257; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PTfotfcn9VWnxLom7GLVbOHjhNjkRdM3f9UH7tzHbYQ=; b=F2Rt2U9XKAM3hMRLQF1GisrFP/4fiMdN+hbpU5NLCFLKPoFuZzggqgzoKuTS601P0u uU8EdD4s6328oWb7byNj+Jmh5dKxZrtGPG0/5XSt1unRkTILF9jvumzLJdWzTCC7hYY8 VsT0y+fK1jsVUcIgMYCZGVSQGrQ9TB0Bl9gd4x28K7pz7aZ7SsJDEbOVNcjfYhTeKDp4 5FikvAYQNslmcrGFKHHynUxhlHyZKFo/OGGD+wZ7EgDKox5IpfnaKlBmFppFoUhHS69f q6WQhrbcvMD2VxC7B666Eqr1ONp8UaDvto+y1BoGbwhnkpcBNjDLVVcXbjorKe948xXc 3AgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783515457; x=1784120257; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=PTfotfcn9VWnxLom7GLVbOHjhNjkRdM3f9UH7tzHbYQ=; b=XmDU03cO9RJWjGRkuqg1C37E5qaMIUKL6tkVZWOPgoeTEY77q0ZDRynMGlgOHOW4fH /z/DJ3znq+YcqAredwcjOGukC2IcFJvTXEbrB5fiodgtuXbnSyYYFLsdoapJDwl9ltxY Pi9opSxe5mt1K5ZNL9qhtRNFQIHifNqY3Ni0WTJpYTxQ/TTYDcFdZVKcjO/RkqnfPBee 80XMS9XUCYl+G8H8cBim/Nm0IhY5L3cbrZNQRq8gj3Hh4XzHIpX00uvGsMUNgjuE27Xf GmIv1Yq9jIoPjDqF+098qSo8AOdbwmWteRYN0S7NSwiPEDnjHEwUMX5VHFez5KNlf7+B azbg== X-Forwarded-Encrypted: i=1; AHgh+RqsNsnK/GBadWhiJ1EHFzlXO2y6iOgj0YR0+nie6KFw9QOfkmYfI+a449VUQ83Ft6JxG921+w4s7nRe5IU=@vger.kernel.org X-Gm-Message-State: AOJu0Yw0lcC5YmvwAnnbG/95wIKISK6RGtYuqTpWuT9vVwFYzowN+/YS Rj2JXYQWhJI6EFVVlgOdMvVZRQryKTZr6HCP7yTkGd7MS4ajcgWfLMFT X-Gm-Gg: AfdE7cnSKHtS50QIOQORc1ILU82NiWW6SC5KI/nihaDeUSGxVXzHnr27nVBQClnIYfS S2ghox4+iVRekaQern1+MoIQMMZXCvGZDYvuBk4szMDl0t7qI9bqsKqgXNIz3wg7m3b4mppWzEy b1c7QBhbSaMvzm1OJiXrdEZtbr3wi2VIizzFGdRX6sCWsM0gGnk4jcN8TLJ9WlaBywTRjCq0FLy 4x0+BdO8V4kdQB4gVR5MdhkkixYK8mKx0F+67GG5gblFburtRnAkLkCb+nsEeTVc08T4l5W7bAn mCuJzkNfelzUq+qxiTBWAyofBP2YfZwUJgS+xDfxc6XFUbg2tQAG/6cpy09rPB9e6dwCUE34XDj 7MEYziOQMs9KhGDuMRsqf+BoGr+sVJGMQu2Wqey3mi9CPywU/9SN+jaSKk0S/OEoGyUKGMwmlaU Tuvcn2/ef5DVG9bUWhw7KE6ac0NIYkDHqd89a+iFXJvEM= X-Received: by 2002:a05:6a21:3383:b0:3bf:b960:6fc4 with SMTP id adf61e73a8af0-3c0bccd3a30mr3293274637.30.1783515457214; Wed, 08 Jul 2026 05:57:37 -0700 (PDT) Received: from localhost.localdomain ([49.207.223.101]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31174accae5sm30299087eec.29.2026.07.08.05.57.33 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 08 Jul 2026 05:57:36 -0700 (PDT) From: Biren Pandya To: sakari.ailus@linux.intel.com, mchehab@kernel.org, songjun.wu@microchip.com, wenyou.yang@microchip.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Biren Pandya , stable@vger.kernel.org Subject: [PATCH v2 2/2] media: i2c: ov7740: fix use-after-destroy in remove Date: Wed, 8 Jul 2026 18:27:23 +0530 Message-ID: <20260708125720.27156-6-birenpandya@gmail.com> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260708125720.27156-4-birenpandya@gmail.com> References: <20260615210412.34567-1-birenpandya@gmail.com> <20260708125720.27156-4-birenpandya@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order. Fixes: 39c5c4471b8d ("media: i2c: Add the ov7740 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Biren Pandya --- v2: added Fixes and Cc stable tags. --- drivers/media/i2c/ov7740.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c index 2d29147c0f647..b4e14171556f9 100644 --- a/drivers/media/i2c/ov7740.c +++ b/drivers/media/i2c/ov7740.c @@ -1116,10 +1116,8 @@ static void ov7740_remove(struct i2c_client *client) struct v4l2_subdev *sd = i2c_get_clientdata(client); struct ov7740 *ov7740 = container_of(sd, struct ov7740, subdev); - mutex_destroy(&ov7740->mutex); - v4l2_ctrl_handler_free(ov7740->subdev.ctrl_handler); - media_entity_cleanup(&ov7740->subdev.entity); v4l2_async_unregister_subdev(sd); + media_entity_cleanup(&ov7740->subdev.entity); ov7740_free_controls(ov7740); pm_runtime_disable(&client->dev); -- 2.50.1 (Apple Git-155)