2010-12-13 15:59:26

by Alexander Strakh

Subject: BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c

KERNEL_VERSION: 2.6.36
SUBJECT: double mutex_lock in drivers/media/video/tlg2300/pd-video.c
in function vidioc_s_fmt
SUBSCRIBE:
First mutex_unlock in function pd_vidioc_s_fmt in line 767:

764 ret |= send_set_req(pd, VIDEO_ROSOLU_SEL,
765 vid_resol, &cmd_status);
766 if (ret || cmd_status) {
767 mutex_unlock(&pd->lock);
768 return -EBUSY;
769 }

Second mutex_unlock in function vidioc_s_fmt in line 806:

805 pd_vidioc_s_fmt(pd, &f->fmt.pix);
806 mutex_unlock(&pd->lock);

Found by Linux Device Drivers Verification Project

Сhecks the return code of pd_vidioc_s_fm before mutex_unlocking.

Signed-off-by: Alexander Strakh <[email protected]>

---
diff --git a/drivers/media/video/tlg2300/pd-video.c
b/drivers/media/video/tlg2300/pd-video.c
index a1ffe18..fe6bd2b 100644
--- a/drivers/media/video/tlg2300/pd-video.c
+++ b/drivers/media/video/tlg2300/pd-video.c
@@ -802,8 +802,8 @@ static int vidioc_s_fmt(struct file *file, void *fh,
struct v4l2_format *f)
return -EINVAL;
}

- pd_vidioc_s_fmt(pd, &f->fmt.pix);
- mutex_unlock(&pd->lock);
+ if(!pd_vidioc_s_fmt(pd, &f->fmt.pix))
+ mutex_unlock(&pd->lock);
return 0;
}

2010-12-14 01:34:49

by Huang Shijie

Subject: Re: BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c

Hi Strakh:

Thanks for your patch.

But I prefer to remove the mutex_unlock() in the pd_vidioc_s_fmt(),
since the pd_vidioc_s_fmt() is also called in restore_v4l2_context().

would you please change the patch?
I will ack it.

Best Regards
Huang Shijie


2010/12/13 Alexander Strakh <[email protected]>:
>        KERNEL_VERSION: 2.6.36
>        SUBJECT: double mutex_lock in drivers/media/video/tlg2300/pd-video.c
> in function vidioc_s_fmt
>        SUBSCRIBE:
>        First mutex_unlock in function pd_vidioc_s_fmt in line 767:
>
>  764        ret |= send_set_req(pd, VIDEO_ROSOLU_SEL,
>  765                                vid_resol, &cmd_status);
>  766        if (ret || cmd_status) {
>  767                mutex_unlock(&pd->lock);
>  768                return -EBUSY;
>  769        }
>
>        Second mutex_unlock in function vidioc_s_fmt in line 806:
>
>  805        pd_vidioc_s_fmt(pd, &f->fmt.pix);
>  806        mutex_unlock(&pd->lock);
>
> Found by Linux Device Drivers Verification Project
>
> Сhecks the return code of pd_vidioc_s_fm before mutex_unlocking.
>
> Signed-off-by: Alexander Strakh <[email protected]>
>
> ---
> diff --git a/drivers/media/video/tlg2300/pd-video.c
> b/drivers/media/video/tlg2300/pd-video.c
> index a1ffe18..fe6bd2b 100644
> --- a/drivers/media/video/tlg2300/pd-video.c
> +++ b/drivers/media/video/tlg2300/pd-video.c
> @@ -802,8 +802,8 @@ static int vidioc_s_fmt(struct file *file, void *fh,
> struct v4l2_format *f)
>                return -EINVAL;
>        }
>
> -       pd_vidioc_s_fmt(pd, &f->fmt.pix);
> -       mutex_unlock(&pd->lock);
> +       if(!pd_vidioc_s_fmt(pd, &f->fmt.pix))
> +               mutex_unlock(&pd->lock);
>        return 0;
>  }
>
>
>

2010-12-22 16:32:55

by Mauro Carvalho Chehab

Subject: Re: BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c

Em 13-12-2010 13:59, iceberg escreveu:
> KERNEL_VERSION: 2.6.36
> SUBJECT: double mutex_lock in drivers/media/video/tlg2300/pd-video.c
> in function vidioc_s_fmt
> SUBSCRIBE:
> First mutex_unlock in function pd_vidioc_s_fmt in line 767:
>
> 764 ret |= send_set_req(pd, VIDEO_ROSOLU_SEL,
> 765 vid_resol, &cmd_status);
> 766 if (ret || cmd_status) {
> 767 mutex_unlock(&pd->lock);
> 768 return -EBUSY;
> 769 }
>
> Second mutex_unlock in function vidioc_s_fmt in line 806:
>
> 805 pd_vidioc_s_fmt(pd, &f->fmt.pix);
> 806 mutex_unlock(&pd->lock);
>
> Found by Linux Device Drivers Verification Project
>
> ?hecks the return code of pd_vidioc_s_fm before mutex_unlocking.
>
> Signed-off-by: Alexander Strakh <[email protected]>
>
> ---
> --
> To unsubscribe from this list: send the line "unsubscribe linux-media" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
> diff --git a/drivers/media/video/tlg2300/pd-video.c
> b/drivers/media/video/tlg2300/pd-video.c
> index a1ffe18..fe6bd2b 100644
> --- a/drivers/media/video/tlg2300/pd-video.c
> +++ b/drivers/media/video/tlg2300/pd-video.c
> @@ -802,8 +802,8 @@ static int vidioc_s_fmt(struct file *file, void *fh,
> struct v4l2_format *f)
> return -EINVAL;
> }
>
> - pd_vidioc_s_fmt(pd, &f->fmt.pix);
> - mutex_unlock(&pd->lock);
> + if (!pd_vidioc_s_fmt(pd, &f->fmt.pix))
> + mutex_unlock(&pd->lock);
> return 0;
> }
>

Thanks for the patch, but the better is to keep the calls to mutex_lock/mutex_unlock
at the same function. So, instead of adding an "if" at vidioc_s_fmt, please remove
the mutex_unlock() from pd_vidioc_s_fmt().

Cheers,
Mauro