ANDROID: goldfish: goldfish_pipe: fix locking errors

If the get_user_pages_fast() call in goldfish_pipe_read_write() failed,
it would return while still holding pipe->lock.

goldfish_pipe_read_write() later releases and tries to re-acquire
pipe->lock.  If the re-acquire call failed, goldfish_pipe_read_write()
would try unlock pipe->lock on exit anyway.

This fixes the smatch messages:

drivers/platform/goldfish/goldfish_pipe.c:392 goldfish_pipe_read_write() error: double unlock 'mutex:&pipe->lock'
drivers/platform/goldfish/goldfish_pipe.c:397 goldfish_pipe_read_write() warn: inconsistent returns 'mutex:&pipe->lock'.

Change-Id: Ifd06a76b32027ca451a001704ade0c5440ed69c4
Signed-off-by: Greg Hackmann <ghackmann@google.com>

diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index cf7ce97..fd1452e 100644 (file)
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -273,11 +273,13 @@ static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer,
                if (ret == 0) {
                        DPRINT("%s: error: (requested pages == 0) (wanted %d)\n",
                                        __FUNCTION__, requested_pages);
+                       mutex_unlock(&pipe->lock);
                        return ret;
                }
                if (ret < 0) {
                        DPRINT("%s: (requested pages < 0) %d \n",
                                        __FUNCTION__, requested_pages);
+                       mutex_unlock(&pipe->lock);
                        return ret;
                }
 
@@ -384,10 +386,8 @@ static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer,
                }
 
                /* Try to re-acquire the lock */
-               if (mutex_lock_interruptible(&pipe->lock)) {
-                       ret = -ERESTARTSYS;
-                       break;
-               }
+               if (mutex_lock_interruptible(&pipe->lock))
+                       return -ERESTARTSYS;
        }
        mutex_unlock(&pipe->lock);