[PATCH] media: mali-c55: Fix double mutex_destroy on capture dev register error

[PATCH] media: mali-c55: Fix double mutex_destroy on capture dev register error

[David Carlier]

In mali_c55_register_cap_dev(), a failure of media_entity_pads_init()
destroys cap_dev->lock inline and then jumps to err_destroy_mutex, which
destroys the same mutex a second time. The switch default case just above
already handles this correctly by jumping straight to the label without an
inline destroy.

Drop the inline mutex_destroy() and rely on the err_destroy_mutex label,
so the mutex is destroyed exactly once on every error path.

Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 drivers/media/platform/arm/mali-c55/mali-c55-capture.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-capture.c b/drivers/media/platform/arm/mali-c55/mali-c55-capture.c
index 7aaa5c3f7..ff0155302 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-capture.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-capture.c
@@ -857,10 +857,8 @@ static int mali_c55_register_cap_dev(struct mali_c55 *mali_c55,
 
 	cap_dev->pad.flags = MEDIA_PAD_FL_SINK;
 	ret = media_entity_pads_init(&cap_dev->vdev.entity, 1, &cap_dev->pad);
-	if (ret) {
-		mutex_destroy(&cap_dev->lock);
+	if (ret)
 		goto err_destroy_mutex;
-	}
 
 	vb2q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
 	vb2q->io_modes = VB2_MMAP | VB2_DMABUF;
-- 
2.53.0

Re: [PATCH] media: mali-c55: Fix double mutex_destroy on capture dev register error

[Jacopo Mondi]

Hi David

On Sun, Jun 28, 2026 at 06:05:03AM +0100, David Carlier wrote:
> In mali_c55_register_cap_dev(), a failure of media_entity_pads_init()
> destroys cap_dev->lock inline and then jumps to err_destroy_mutex, which
> destroys the same mutex a second time. The switch default case just above
> already handles this correctly by jumping straight to the label without an
> inline destroy.
>
> Drop the inline mutex_destroy() and rely on the err_destroy_mutex label,
> so the mutex is destroyed exactly once on every error path.
>
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")

Calling mutex_destroy() twice should be harmless, I don't think this
qualfies as a fix ?

And in any case, remember to Cc: stable whenever you send a Fixes.

> Signed-off-by: David Carlier <devnexen@gmail.com>
> ---
>  drivers/media/platform/arm/mali-c55/mali-c55-capture.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-capture.c b/drivers/media/platform/arm/mali-c55/mali-c55-capture.c
> index 7aaa5c3f7..ff0155302 100644
> --- a/drivers/media/platform/arm/mali-c55/mali-c55-capture.c
> +++ b/drivers/media/platform/arm/mali-c55/mali-c55-capture.c
> @@ -857,10 +857,8 @@ static int mali_c55_register_cap_dev(struct mali_c55 *mali_c55,
>
>  	cap_dev->pad.flags = MEDIA_PAD_FL_SINK;
>  	ret = media_entity_pads_init(&cap_dev->vdev.entity, 1, &cap_dev->pad);
> -	if (ret) {
> -		mutex_destroy(&cap_dev->lock);
> +	if (ret)
>  		goto err_destroy_mutex;
> -	}

Indeed!
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>

>
>  	vb2q->type = V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE;
>  	vb2q->io_modes = VB2_MMAP | VB2_DMABUF;
> --
> 2.53.0
>
>