gb_lights_light_register() registers each channel before initializing
light->channels[i].lock. Channel registration exposes the LED class
device and its brightness callback, which later takes this mutex. A
concurrent brightness update can therefore hit an uninitialized lock.

Initialize the channel mutex before registering the channel so the
callback always sees a valid lock.

Fixes: cc43368a3cde ("greybus: lights: Control runtime pm suspend/resume on AP side")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/staging/greybus/light.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
index 38c233a706c4..056ef6b0276e 100644
--- a/drivers/staging/greybus/light.c
+++ b/drivers/staging/greybus/light.c
@@ -1043,11 +1043,11 @@ static int gb_lights_light_register(struct gb_light *light)
 	 * found.
 	 */
 	for (i = 0; i < light->channels_count; i++) {
+		mutex_init(&light->channels[i].lock);
+
 		ret = gb_lights_channel_register(&light->channels[i]);
 		if (ret < 0)
 			return ret;
-
-		mutex_init(&light->channels[i].lock);
 	}
 
 	light->ready = true;
-- 
2.34.1

On Tue, Aug 18, 2026 at 10:20:20PM +0800, Runyu Xiao wrote:
> gb_lights_light_register() registers each channel before initializing
> light->channels[i].lock. Channel registration exposes the LED class
> device and its brightness callback, which later takes this mutex. A
> concurrent brightness update can therefore hit an uninitialized lock.
> 
> Initialize the channel mutex before registering the channel so the
> callback always sees a valid lock.
> 
> Fixes: cc43368a3cde ("greybus: lights: Control runtime pm suspend/resume on AP side")
> Cc: stable@vger.kernel.org
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  drivers/staging/greybus/light.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
> index 38c233a706c4..056ef6b0276e 100644
> --- a/drivers/staging/greybus/light.c
> +++ b/drivers/staging/greybus/light.c
> @@ -1043,11 +1043,11 @@ static int gb_lights_light_register(struct gb_light *light)
>  	 * found.
>  	 */
>  	for (i = 0; i < light->channels_count; i++) {
> +		mutex_init(&light->channels[i].lock);
> +
>  		ret = gb_lights_channel_register(&light->channels[i]);
>  		if (ret < 0)
>  			return ret;
> -
> -		mutex_init(&light->channels[i].lock);
>  	}
>  
>  	light->ready = true;

How was this found and tested?

thanks,

greg k-h