[PATCH] media: usb: as102: initialize mutexes before registration

[Joel Peech]

as102_dvb_register() initializes as102_dev->sem and bus_adap.lock
after registering DVB demux and frontend objects. Those registration
paths can expose callbacks before the mutexes are initialized.

syzbot can then reach as102_dvb_dmx_start_feed(), which locks
as102_dev->sem and triggers lockdep's uninitialized-lock warning.
Frontend callbacks can also use bus_adap.lock after
dvb_register_frontend().

Initialize both mutexes before the demux and frontend callbacks are
registered.

Reported-by: syzbot+3825a6102073c418fe41@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=3825a6102073c418fe41
Link: https://lore.kernel.org/r/tencent_F063E97E23B8C4431762377E26CC336AE305@xxxxxx
Assisted-by: Codex:GPT-5
Signed-off-by: Joel Peech <linux@xxxxxxxxxx>
---
 drivers/media/usb/as102/as102_drv.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/as102/as102_drv.c b/drivers/media/usb/as102/as102_drv.c
index 6b1d3528a..60827acd7 100644
--- a/drivers/media/usb/as102/as102_drv.c
+++ b/drivers/media/usb/as102/as102_drv.c
@@ -296,6 +296,12 @@ int as102_dvb_register(struct as102_dev_t *as102_dev)
 		return ret;
 	}
 
+	/* init bus mutex for token locking */
+	mutex_init(&as102_dev->bus_adap.lock);
+
+	/* init start / stop stream mutex */
+	mutex_init(&as102_dev->sem);
+
 	as102_dev->dvb_dmx.priv = as102_dev;
 	as102_dev->dvb_dmx.filternum = pid_filtering ? 16 : 256;
 	as102_dev->dvb_dmx.feednum = 256;
@@ -341,12 +347,6 @@ int as102_dvb_register(struct as102_dev_t *as102_dev)
 		goto efereg;
 	}
 
-	/* init bus mutex for token locking */
-	mutex_init(&as102_dev->bus_adap.lock);
-
-	/* init start / stop stream mutex */
-	mutex_init(&as102_dev->sem);
-
 	/*
 	 * try to load as102 firmware. If firmware upload failed, we'll be
 	 * able to upload it later.

base-commit: 6f3ed7fec72fc8979b2a8c7219c0a9fcfc8d07b5
-- 
2.54.0