Re: [PATCH 1/2] media: i2c: ov7740: Fix use-after-destroy in remove()

[Sakari Ailus]

Hi Biren,

On Tue, Jun 16, 2026 at 02:34:11AM +0530, Biren Pandya wrote:
> The ov7740_remove() function had a severe teardown order bug where it
> destroyed the driver's mutex before freeing the V4L2 control handler
> which relies on that mutex, leading to a use-after-destroy kernel panic.
> Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and
> mutex_destroy() sequentially, but then called ov7740_free_controls()
> which invokes both of them a second time, resulting in a double-free.
> 
> This patch fixes the issue by unregistering the subdevice first, and
> relying exclusively on ov7740_free_controls() to safely tear down the
> mutex and control handler in the correct order.
> 
> Fixes: 39c5c4471b8d ("media: i2c: Add the ov7740 image sensor driver")
> Signed-off-by: Biren Pandya <birenpandya@xxxxxxxxx>

Can you add Cc: stable... for v2, please?

> ---
>  drivers/media/i2c/ov7740.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/drivers/media/i2c/ov7740.c b/drivers/media/i2c/ov7740.c
> index 632fb80469be..62c124a1353a 100644
> --- a/drivers/media/i2c/ov7740.c
> +++ b/drivers/media/i2c/ov7740.c
> @@ -1116,10 +1116,8 @@ static void ov7740_remove(struct i2c_client *client)
>  	struct v4l2_subdev *sd = i2c_get_clientdata(client);
>  	struct ov7740 *ov7740 = container_of(sd, struct ov7740, subdev);
>  
> -	mutex_destroy(&ov7740->mutex);
> -	v4l2_ctrl_handler_free(ov7740->subdev.ctrl_handler);
> -	media_entity_cleanup(&ov7740->subdev.entity);
>  	v4l2_async_unregister_subdev(sd);
> +	media_entity_cleanup(&ov7740->subdev.entity);
>  	ov7740_free_controls(ov7740);
>  
>  	pm_runtime_get_sync(&client->dev);

-- 
Kind regards,

Sakari Ailus