BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c

[Alexander Strakh]

        KERNEL_VERSION: 2.6.36
        SUBJECT: double mutex_lock in drivers/media/video/tlg2300/pd-video.c 
in function vidioc_s_fmt
        SUBSCRIBE:
	First mutex_unlock in function pd_vidioc_s_fmt in line 767:

 764        ret |= send_set_req(pd, VIDEO_ROSOLU_SEL,
 765                                vid_resol, &cmd_status);
 766        if (ret || cmd_status) {
 767                mutex_unlock(&pd->lock);
 768                return -EBUSY;
 769        }

	Second mutex_unlock in function vidioc_s_fmt in line 806:

 805        pd_vidioc_s_fmt(pd, &f->fmt.pix);
 806        mutex_unlock(&pd->lock);

Found by Linux Device Drivers Verification Project

Ðhecks the return code of pd_vidioc_s_fm before mutex_unlocking.

Signed-off-by: Alexander Strakh <strakh@xxxxxxxxx>

---
diff --git a/drivers/media/video/tlg2300/pd-video.c 
b/drivers/media/video/tlg2300/pd-video.c
index a1ffe18..fe6bd2b 100644
--- a/drivers/media/video/tlg2300/pd-video.c
+++ b/drivers/media/video/tlg2300/pd-video.c
@@ -802,8 +802,8 @@ static int vidioc_s_fmt(struct file *file, void *fh, 
struct v4l2_format *f)
 		return -EINVAL;
 	}
 
-	pd_vidioc_s_fmt(pd, &f->fmt.pix);
-	mutex_unlock(&pd->lock);
+	if(!pd_vidioc_s_fmt(pd, &f->fmt.pix)) 
+		mutex_unlock(&pd->lock);
 	return 0;
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/