From: Iago Abal <mail@xxxxxxxxxxx> Commit 73d5c5c864f4 protected the body of `tt3650_ci_msg' with state->ca_mutex. This is not needed: 1) this function is always called from a context where that lock is held; and 2) there exists a `tt3650_ci_msg_locked' wrapper that does exactly the same. This leads to double lock as reported by the EBA (http://www.iagoabal.eu/eba) static bug finder: a) Function `tt3650_ci_msg_locked' takes state->ca_mutex in line 156 and then calls `tt3650_ci_msg' in line 157. b) Function `tt3650_ci_slot_reset' takes state->ca_mutex in line 297 and then calls `tt3650_ci_msg' in line 299. Fixes: 73d5c5c864f4 ("[media] pctv452e: don't do DMA on stack") Signed-off-by: Iago Abal <mail@xxxxxxxxxxx> --- drivers/media/usb/dvb-usb/pctv452e.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/media/usb/dvb-usb/pctv452e.c b/drivers/media/usb/dvb-usb/pctv452e.c index 07fa08b..c718fd9 100644 --- a/drivers/media/usb/dvb-usb/pctv452e.c +++ b/drivers/media/usb/dvb-usb/pctv452e.c @@ -114,7 +114,6 @@ static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data, return -EIO; } - mutex_lock(&state->ca_mutex); id = state->c++; state->data[0] = SYNC_BYTE_OUT; @@ -136,7 +135,6 @@ static int tt3650_ci_msg(struct dvb_usb_device *d, u8 cmd, u8 *data, memcpy(data, state->data + 4, read_len); - mutex_unlock(&state->ca_mutex); return 0; failed: -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
