When cx231xx_register_analog_devices() fails, cx231xx_init_dev() jumps to
err_analog and calls cx231xx_unregister_media_device(), which frees
dev->media_dev while dev->v4l2_dev.mdev still aliases it. The next line,
cx231xx_release_analog_resources(), releases the video device, so
v4l2_device_release() takes the freed media device's graph_mutex in
media_devnode_remove(). Remove that free from err_analog and leave it to
cx231xx_usb_probe(), which frees the media device at err_v4l2, after
cx231xx_release_analog_resources() has released the video devices and
v4l2_device_unregister() has dropped the subdevs.

Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
---
The device was emulated.

--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1505,7 +1505,7 @@ static int cx231xx_init_dev(struct cx231xx *dev,
struct usb_device *udev,

 	return 0;
 err_analog:
-	cx231xx_unregister_media_device(dev);
+	/* dev->v4l2_dev.mdev aliases media_dev until probe's err_v4l2 frees it. */
 	cx231xx_release_analog_resources(dev);
 	cx231xx_remove_from_devlist(dev);
 err_dev_init:

On 11/09/2026 07:48, Farhad Alemi wrote:
> When cx231xx_register_analog_devices() fails, cx231xx_init_dev() jumps to
> err_analog and calls cx231xx_unregister_media_device(), which frees
> dev->media_dev while dev->v4l2_dev.mdev still aliases it. The next line,
> cx231xx_release_analog_resources(), releases the video device, so
> v4l2_device_release() takes the freed media device's graph_mutex in
> media_devnode_remove(). Remove that free from err_analog and leave it to
> cx231xx_usb_probe(), which frees the media device at err_v4l2, after
> cx231xx_release_analog_resources() has released the video devices and
> v4l2_device_unregister() has dropped the subdevs.
> 
> Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> ---
> The device was emulated.
> 

This patch doesn't apply, you're missing a
---

line here.

> --- a/drivers/media/usb/cx231xx/cx231xx-cards.c
> +++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
> @@ -1505,7 +1505,7 @@ static int cx231xx_init_dev(struct cx231xx *dev,
> struct usb_device *udev,

And this is mangled.

You need to get your mail settings sorted first so it doesn't mess up
patches.

Regards,

	Hans

> 
>  	return 0;
>  err_analog:
> -	cx231xx_unregister_media_device(dev);
> +	/* dev->v4l2_dev.mdev aliases media_dev until probe's err_v4l2 frees it. */
>  	cx231xx_release_analog_resources(dev);
>  	cx231xx_remove_from_devlist(dev);
>  err_dev_init:
>