Re: [PATCH] media: usb: as102: initialize mutexes before registration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] If `as102_start_stream()` fails, `as102_dev->streaming` is left incremented, permanently breaking the hardware streaming state.
--

commit 2c8befce227c56474dec3c665bf27984a30ca17a
Author: Joel Peech <linux@jrpmail.ca>

media: usb: as102: initialize mutexes before registration

This commit moves the initialization of bus_adap.lock and as102_dev->sem
to occur before registering DVB demux and frontend objects. This prevents
callbacks from using these mutexes before they are initialized, resolving
a lockdep warning.

Reported-by: syzbot+3825a6102073c418fe41@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3825a6102073c418fe41
Link: https://lore.kernel.org/r/tencent_F063E97E23B8C4431762377E26CC336AE305@qq.com

> diff --git a/drivers/media/usb/as102/as102_drv.c b/drivers/media/usb/as102/as102_drv.c
> index 6b1d3528a0a7f..60827acd73f87 100644
> --- a/drivers/media/usb/as102/as102_drv.c
> +++ b/drivers/media/usb/as102/as102_drv.c
> @@ -296,6 +296,12 @@ int as102_dvb_register(struct as102_dev_t *as102_dev)
>  		return ret;
>  	}
>  
> +	/* init bus mutex for token locking */
> +	mutex_init(&as102_dev->bus_adap.lock);
> +
> +	/* init start / stop stream mutex */
> +	mutex_init(&as102_dev->sem);
> +
>  	as102_dev->dvb_dmx.priv = as102_dev;
>  	as102_dev->dvb_dmx.filternum = pid_filtering ? 16 : 256;

[ ... ]

[Severity: High]
This is a pre-existing issue, but does this error handling leave the hardware
stream state permanently desynchronized?

Looking at as102_dvb_dmx_start_feed() which takes this newly initialized
mutex, the streaming counter is incremented unconditionally before attempting
to start the stream:

drivers/media/usb/as102/as102_drv.c:as102_dvb_dmx_start_feed() {
        ...
        if (as102_dev->streaming++ == 0)
                ret = as102_start_stream(as102_dev);

        mutex_unlock(&as102_dev->sem);
        return ret;
}

If as102_start_stream() fails, it returns an error directly while leaving
the streaming counter incremented.

The DVB core handles the feed creation failure by aborting, which means it
will not call stop_feed() during cleanup. Because the streaming counter
remains greater than zero, subsequent calls to start a feed will skip
as102_start_stream() entirely.

Does this counter need to be decremented when as102_start_stream() returns
an error to ensure the device can recover from stream start failures?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260602155529.4097328-1-linux@jrpmail.ca?part=1