BUG mutex_unlock without mutex_lock in drivers/pnp/isapnp/core.c

[Alexander Strakh]

	KERNEL_VERSION: 2.6.33
	SUBJECT: mutex_unlock without mutex_lock
	DESCRIBE:
	In drivers/pnp/isapnp/core.c in function isapnp_get_resources:

 1. In line 906 we call isapnp_cfg_begin(dev->card->number, dev->number);

 900 static int isapnp_get_resources(struct pnp_dev *dev)
 901 {
 902         int i, ret;
 903
 904         pnp_dbg(&dev->dev, "get resources\n");
 905         pnp_init_resources(dev);
 906         isapnp_cfg_begin(dev->card->number, dev->number);
...

2. If csn<1 or csn > isapnp_csn_count or logdev > 10 then function returns -
EINVAL and does not call mutex_lock.

 856 int isapnp_cfg_begin(int csn, int logdev)
 857 {
 858         if (csn < 1 || csn > isapnp_csn_count || logdev > 10)
 859                 return -EINVAL;
 860         mutex_lock(&isapnp_cfg_mutex);
...

3. Suppose function isapnp_read_bytes returned a null value. In this case we 
goto line 932 and call isapnp_cfg_end.

 907         dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
 908         if (!dev->active)
 909                 goto __end;
...
 932 __end:
 933         isapnp_cfg_end();
 934         return 0;
 935 }

4. isapnp_cfg_end in line  886 calls mutex_unlock on &isapnp_cfg_mutex without 
mutex_lock (it was not locked in function isapnp_cfg_begin because of -
EINVAL).

 883 int isapnp_cfg_end(void)
 884 {
 885         isapnp_wait();
 886         mutex_unlock(&isapnp_cfg_mutex);
 887         return 0;
 888 }

Found by Linux Device Drivers Verification Project
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/