From: Hans de Goede Date: Thu, 18 May 2023 14:15:07 +0000 (+0100) Subject: media: atomisp: gc0310: Fix double free in gc0310_remove() X-Git-Tag: v6.5-rc1~48^2~84 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=2746a966f9f05fdb0727f4e1e8f2d51ec79e071d;p=linux-2.6-block.git media: atomisp: gc0310: Fix double free in gc0310_remove() gc0310_remove() must not call kfree(dev) since the gc0310_device struct is devm managed so explicitly freeing it causes a double free. While at it add a missing mutex_destroy() call for the input_lock. Link: https://lore.kernel.org/r/20230518153214.194976-6-hdegoede@redhat.com Fixes: 340b4dd6c183 ("media: atomisp: gc0310: Use devm_kzalloc() for data struct") Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c b/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c index c1590ad8f66f..af791cfc9e9a 100644 --- a/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c +++ b/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c @@ -377,8 +377,8 @@ static void gc0310_remove(struct i2c_client *client) v4l2_device_unregister_subdev(sd); media_entity_cleanup(&dev->sd.entity); v4l2_ctrl_handler_free(&dev->ctrls.handler); + mutex_destroy(&dev->input_lock); pm_runtime_disable(&client->dev); - kfree(dev); } static int gc0310_probe(struct i2c_client *client)