Fwd: Re: BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c

[Alexander Strakh <strakh@ispras.ru>]

[-- Attachment #1: Type: text/plain, Size: 1 bytes --]



[-- Attachment #2: Alexander Strakh <strakh@ispras.ru>: Re: BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c --]
[-- Type: message/rfc822, Size: 3191 bytes --]

From: Alexander Strakh <strakh@ispras.ru>
To: Huang Shijie <shijie8@gmail.com>
Subject: Re: BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c
Date: Wed, 15 Dec 2010 17:19:32 +0300
Message-ID: <201012151719.33086.strakh@ispras.ru>

Hello,

> Hi Strakh:
> 
> Thanks for your patch.
> 
> But I prefer to remove the mutex_unlock() in the pd_vidioc_s_fmt(),
> since the pd_vidioc_s_fmt() is also called in restore_v4l2_context().
> 
> would you please change the patch?
> I will ack it.
> 
> Best Regards
> Huang Shijie
> 
> 2010/12/13 Alexander Strakh <strakh@ispras.ru>:
> >        KERNEL_VERSION: 2.6.36
> >        SUBJECT: double mutex_lock in
> > drivers/media/video/tlg2300/pd-video.c in function vidioc_s_fmt
> >        SUBSCRIBE:
> >        First mutex_unlock in function pd_vidioc_s_fmt in line 767:
> > 
> >  764        ret |= send_set_req(pd, VIDEO_ROSOLU_SEL,
> >  765                                vid_resol, &cmd_status);
> >  766        if (ret || cmd_status) {
> >  767                mutex_unlock(&pd->lock);
> >  768                return -EBUSY;
> >  769        }
> > 
> >        Second mutex_unlock in function vidioc_s_fmt in line 806:
> > 
> >  805        pd_vidioc_s_fmt(pd, &f->fmt.pix);
> >  806        mutex_unlock(&pd->lock);
> > 
> > Found by Linux Device Drivers Verification Project
> > 
> > Сhecks the return code of pd_vidioc_s_fm before mutex_unlocking.
> > 
> > Signed-off-by: Alexander Strakh <strakh@ispras.ru>
> > 
> > ---
> > diff --git a/drivers/media/video/tlg2300/pd-video.c
> > b/drivers/media/video/tlg2300/pd-video.c
> > index a1ffe18..fe6bd2b 100644
> > --- a/drivers/media/video/tlg2300/pd-video.c
> > +++ b/drivers/media/video/tlg2300/pd-video.c
> > @@ -802,8 +802,8 @@ static int vidioc_s_fmt(struct file *file, void *fh,
> > struct v4l2_format *f)
> >                return -EINVAL;
> >        }
> > 
> > -       pd_vidioc_s_fmt(pd, &f->fmt.pix);
> > -       mutex_unlock(&pd->lock);
> > +       if(!pd_vidioc_s_fmt(pd, &f->fmt.pix))
> > +               mutex_unlock(&pd->lock);
> >        return 0;
> >  }

 Removing mutex_unlock from pd_vidioc_s_fmt().

---
diff --git a/drivers/media/video/tlg2300/pd-video.c 
b/drivers/media/video/tlg2300/pd-video.c
index a1ffe18..6eb4538 100644
--- a/drivers/media/video/tlg2300/pd-video.c
+++ b/drivers/media/video/tlg2300/pd-video.c
@@ -763,10 +763,8 @@ static int pd_vidioc_s_fmt(struct poseidon *pd, struct 
v4l2_pix_format *pix)
 	}
 	ret |= send_set_req(pd, VIDEO_ROSOLU_SEL,
 				vid_resol, &cmd_status);
-	if (ret || cmd_status) {
-		mutex_unlock(&pd->lock);
+	if (ret || cmd_status)
 		return -EBUSY;
-	}
 
 	pix_def->pixelformat = pix->pixelformat; /* save it */
 	pix->height = (context->tvnormid & V4L2_STD_525_60) ?  480 : 576;