linux-kernel - Re: BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi=4CZ2LD8cj_cjnb5yyyML+M6T=57EjT_hD4TBn@mail.gmail.com>
Date:	Tue, 14 Dec 2010 09:34:46 +0800
From:	Huang Shijie <shijie8@...il.com>
To:	Alexander Strakh <strakh@...ras.ru>
Cc:	linux-kernel@...r.kernel.org, kangyong@...egent.com,
	xbzhang@...egent.com, zyziii@...egent.com,
	Mauro Carvalho Chehab <mchehab@...radead.org>,
	linux-media@...r.kernel.org
Subject: Re: BUG: double mutex_unlock in drivers/media/video/tlg2300/pd-video.c

Hi Strakh:

Thanks for your patch.

But I prefer to remove the mutex_unlock() in the pd_vidioc_s_fmt(),
since the pd_vidioc_s_fmt() is also called in restore_v4l2_context().

would you please change the patch?
I will ack it.

Best Regards
Huang Shijie


2010/12/13 Alexander Strakh <strakh@...ras.ru>:
>        KERNEL_VERSION: 2.6.36
>        SUBJECT: double mutex_lock in drivers/media/video/tlg2300/pd-video.c
> in function vidioc_s_fmt
>        SUBSCRIBE:
>        First mutex_unlock in function pd_vidioc_s_fmt in line 767:
>
>  764        ret |= send_set_req(pd, VIDEO_ROSOLU_SEL,
>  765                                vid_resol, &cmd_status);
>  766        if (ret || cmd_status) {
>  767                mutex_unlock(&pd->lock);
>  768                return -EBUSY;
>  769        }
>
>        Second mutex_unlock in function vidioc_s_fmt in line 806:
>
>  805        pd_vidioc_s_fmt(pd, &f->fmt.pix);
>  806        mutex_unlock(&pd->lock);
>
> Found by Linux Device Drivers Verification Project
>
> Сhecks the return code of pd_vidioc_s_fm before mutex_unlocking.
>
> Signed-off-by: Alexander Strakh <strakh@...ras.ru>
>
> ---
> diff --git a/drivers/media/video/tlg2300/pd-video.c
> b/drivers/media/video/tlg2300/pd-video.c
> index a1ffe18..fe6bd2b 100644
> --- a/drivers/media/video/tlg2300/pd-video.c
> +++ b/drivers/media/video/tlg2300/pd-video.c
> @@ -802,8 +802,8 @@ static int vidioc_s_fmt(struct file *file, void *fh,
> struct v4l2_format *f)
>                return -EINVAL;
>        }
>
> -       pd_vidioc_s_fmt(pd, &f->fmt.pix);
> -       mutex_unlock(&pd->lock);
> +       if(!pd_vidioc_s_fmt(pd, &f->fmt.pix))
> +               mutex_unlock(&pd->lock);
>        return 0;
>  }
>
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/