BUG mutex_unlock without mutex_lock in drivers/pnp/isapnp/core.c

[Alexander Strakh]

KERNEL_VERSION: 2.6.33
SUBJECT: mutex_unlock without mutex_lock
DESCRIBE:
In drivers/pnp/isapnp/core.c in function isapnp_get_resources:

1. In line 906 we call isapnp_cfg_begin(dev->card->number, dev->number);

900 static int isapnp_get_resources(struct pnp_dev *dev)
901 {
902 int i, ret;
903
904 pnp_dbg(&dev->dev, "get resources\n");
905 pnp_init_resources(dev);
906 isapnp_cfg_begin(dev->card->number, dev->number);
...

2. If csn<1 or csn > isapnp_csn_count or logdev > 10 then function returns -
EINVAL and does not call mutex_lock.

856 int isapnp_cfg_begin(int csn, int logdev)
857 {
858 if (csn < 1 || csn > isapnp_csn_count || logdev > 10)
859 return -EINVAL;
860 mutex_lock(&isapnp_cfg_mutex);
...

3. Suppose function isapnp_read_bytes returned a null value. In this case we
goto line 932 and call isapnp_cfg_end.

907 dev->active = isapnp_read_byte(ISAPNP_CFG_ACTIVATE);
908 if (!dev->active)
909 goto __end;
...
932 __end:
933 isapnp_cfg_end();
934 return 0;
935 }

4. isapnp_cfg_end in line 886 calls mutex_unlock on &isapnp_cfg_mutex without
mutex_lock (it was not locked in function isapnp_cfg_begin because of -
EINVAL).

883 int isapnp_cfg_end(void)
884 {
885 isapnp_wait();
886 mutex_unlock(&isapnp_cfg_mutex);
887 return 0;
888 }

Found by Linux Device Drivers Verification Project
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[Bjorn Helgaas]

On Monday 01 March 2010 08:59:40 am Alexander Strakh wrote:
> KERNEL_VERSION: 2.6.33
> SUBJECT: mutex_unlock without mutex_lock
> DESCRIBE:
> In drivers/pnp/isapnp/core.c in function isapnp_get_resources:
>

> ...

> 4. isapnp_cfg_end in line 886 calls mutex_unlock on &isapnp_cfg_mutex without
> mutex_lock (it was not locked in function isapnp_cfg_begin because of -
> EINVAL).

Looks like a bug to me. I'll send a patch.

Bjorn