On Wed Jul 8 18:27:23 2026 +0530, Biren Pandya wrote:
> The ov7740_remove() function had a severe teardown order bug where it
> destroyed the driver's mutex before freeing the V4L2 control handler
> which relies on that mutex, leading to a use-after-destroy kernel panic.
> Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and
> mutex_destroy() sequentially, but then called ov7740_free_controls()
> which invokes both of them a second time, resulting in a double-free.
>
> This patch fixes the issue by unregistering the subdevice first, and
> relying exclusively on ov7740_free_controls() to safely tear down the
> mutex and control handler in the correct order.
>
> Fixes: 39c5c4471b8d ("media: i2c: Add the ov7740 image sensor driver")
> Cc: [email protected]
> Signed-off-by: Biren Pandya <[email protected]>
> Signed-off-by: Sakari Ailus <[email protected]>
Patch committed.
Thanks,
Sakari Ailus
drivers/media/i2c/ov7740.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
---
diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c
index 2d29147c0f64..b4e14171556f 100644
--- a/drivers/media/i2c/ov7740.c
+++ b/drivers/media/i2c/ov7740.c
@@ -1116,10 +1116,8 @@ static void ov7740_remove(struct i2c_client *client)
struct v4l2_subdev *sd = i2c_get_clientdata(client);
struct ov7740 *ov7740 = container_of(sd, struct ov7740, subdev);
- mutex_destroy(&ov7740->mutex);
- v4l2_ctrl_handler_free(ov7740->subdev.ctrl_handler);
- media_entity_cleanup(&ov7740->subdev.entity);
v4l2_async_unregister_subdev(sd);
+ media_entity_cleanup(&ov7740->subdev.entity);
ov7740_free_controls(ov7740);
pm_runtime_disable(&client->dev);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
