BUG mutex_unlock without mutex_lock in drivers/pnp/isapnp/core.c

BUG mutex_unlock without mutex_lock in drivers/pnp/isapnp/core.c

[Alexander Strakh]

	KERNEL_VERSION: 2.6.33
	SUBJECT: mutex_unlock without mutex_lock
	DESCRIBE:
	In drivers/pnp/isapnp/core.c in function isapnp_get_resources:

 1. In line 906 we call isapnp_cfg_begin(dev->card->number, dev->number);

 900 static int isapnp_get_resources(struct pnp_dev *dev)
 901 {
 902         int i, ret;
 903
 904         pnp_dbg(&dev->dev, "get resources\n");
 905         pnp_init_resources(dev);
 906         isapnp_cfg_begin(dev->card->number, dev->number);
...

2. If csn<1 or csn > isapnp_csn_count or logdev > 10 then function returns -
EINVAL and does not call mutex_lock.

 856 int isapnp_cfg_begin(int csn, int logdev)
 857 {
 858         if (csn < 1 || csn > isapnp_csn_count || logdev > 10)
 859                 return -EINVAL;
 860         mutex_lock(&isapnp_cfg_mutex);
...

3. Suppose function isapnp_read_bytes returned a null value. In this case we 
goto line 932 and call isapnp_cfg_end.

 907         dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
 908         if (!dev->active)
 909                 goto __end;
...
 932 __end:
 933         isapnp_cfg_end();
 934         return 0;
 935 }

4. isapnp_cfg_end in line  886 calls mutex_unlock on &isapnp_cfg_mutex without 
mutex_lock (it was not locked in function isapnp_cfg_begin because of -
EINVAL).

 883 int isapnp_cfg_end(void)
 884 {
 885         isapnp_wait();
 886         mutex_unlock(&isapnp_cfg_mutex);
 887         return 0;
 888 }

Found by Linux Device Drivers Verification Project

Re: BUG mutex_unlock without mutex_lock in drivers/pnp/isapnp/core.c

[Bjorn Helgaas]

On Monday 01 March 2010 08:59:40 am Alexander Strakh wrote:
> 	KERNEL_VERSION: 2.6.33
> 	SUBJECT: mutex_unlock without mutex_lock
> 	DESCRIBE:
> 	In drivers/pnp/isapnp/core.c in function isapnp_get_resources:
> 
> ...
> 4. isapnp_cfg_end in line  886 calls mutex_unlock on &isapnp_cfg_mutex without 
> mutex_lock (it was not locked in function isapnp_cfg_begin because of -
> EINVAL).

Looks like a bug to me.  I'll send a patch.

Bjorn