Commit 59a12641 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: iio/dds: double locking bugs 



This is a static checker patch and I don't have this hardware.

This code is unusual because while I've often seen a double lock, this
is the first time I've seen code that takes a lock 11 times in a row.  I
feel like I must have missed something.  But I've looked very carefully
I don't see any way the original code is correct.  Does spi_sync()
somehow release the lock in a way that I can't see?  Even if it does,
the locking would still be wrong.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Acked-by: default avatarMichael Hennerich <michael.hennerich@analog.com>
Acked-by: default avatarCliff Cai <cliff.cai@analog.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent a1a26e49

drivers/staging/iio/dds/ad9832.c

+0 −2
Original line number Original line Diff line number Diff line
@@ -166,8 +166,6 @@ static void ad9832_init(struct ad9832_state *st) 




	config = 0x3 << 14;

	config = 0x3 << 14;





	mutex_lock(&st->lock);



	xfer.len = 2;

	xfer.len = 2;

	xfer.tx_buf = &config;

	xfer.tx_buf = &config;

drivers/staging/iio/dds/ad9852.c

+1 −10
Original line number Original line Diff line number Diff line
@@ -86,7 +86,6 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 3;

	xfer.len = 3;

	xfer.tx_buf = &config->phajst1[0];

	xfer.tx_buf = &config->phajst1[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -96,7 +95,6 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 6;

	xfer.len = 6;

	xfer.tx_buf = &config->fretun1[0];

	xfer.tx_buf = &config->fretun1[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -106,7 +104,6 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 6;

	xfer.len = 6;

	xfer.tx_buf = &config->fretun2[0];

	xfer.tx_buf = &config->fretun2[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -116,7 +113,6 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 6;

	xfer.len = 6;

	xfer.tx_buf = &config->dltafre[0];

	xfer.tx_buf = &config->dltafre[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -126,7 +122,6 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &config->updtclk[0];

	xfer.tx_buf = &config->updtclk[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -136,7 +131,6 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 4;

	xfer.len = 4;

	xfer.tx_buf = &config->ramprat[0];

	xfer.tx_buf = &config->ramprat[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -146,7 +140,6 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &config->control[0];

	xfer.tx_buf = &config->control[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -156,7 +149,6 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 3;

	xfer.len = 3;

	xfer.tx_buf = &config->outpskm[0];

	xfer.tx_buf = &config->outpskm[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -166,16 +158,15 @@ static ssize_t ad9852_set_parameter(struct device *dev, 




	xfer.len = 2;

	xfer.len = 2;

	xfer.tx_buf = &config->outpskr[0];

	xfer.tx_buf = &config->outpskr[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);

	ret = spi_sync(st->sdev, &msg);

	ret = spi_sync(st->sdev, &msg);

	if (ret)

	if (ret)

		goto error_ret;

		goto error_ret;



	xfer.len = 3;

	xfer.len = 3;

	xfer.tx_buf = &config->daccntl[0];

	xfer.tx_buf = &config->daccntl[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);

drivers/staging/iio/dds/ad9910.c

+6 −20
Original line number Original line Diff line number Diff line
@@ -138,7 +138,6 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &config->ioupd[0];

	xfer.tx_buf = &config->ioupd[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -148,7 +147,6 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &config->ftw[0];

	xfer.tx_buf = &config->ftw[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -158,7 +156,6 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 3;

	xfer.len = 3;

	xfer.tx_buf = &config->pow[0];

	xfer.tx_buf = &config->pow[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -168,7 +165,6 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &config->asf[0];

	xfer.tx_buf = &config->asf[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -178,7 +174,6 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &config->multc[0];

	xfer.tx_buf = &config->multc[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -188,7 +183,6 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->dig_rampl[0];

	xfer.tx_buf = &config->dig_rampl[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -198,7 +192,6 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->dig_ramps[0];

	xfer.tx_buf = &config->dig_ramps[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -208,7 +201,6 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &config->dig_rampr[0];

	xfer.tx_buf = &config->dig_rampr[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -218,25 +210,24 @@ static ssize_t ad9910_set_parameter(struct device *dev, 




	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->sin_tonep0[0];

	xfer.tx_buf = &config->sin_tonep0[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);

	ret = spi_sync(st->sdev, &msg);

	ret = spi_sync(st->sdev, &msg);

	if (ret)

	if (ret)

		goto error_ret;

		goto error_ret;



	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->sin_tonep1[0];

	xfer.tx_buf = &config->sin_tonep1[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);

	ret = spi_sync(st->sdev, &msg);

	ret = spi_sync(st->sdev, &msg);

	if (ret)

	if (ret)

		goto error_ret;

		goto error_ret;



	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->sin_tonep2[0];

	xfer.tx_buf = &config->sin_tonep2[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -245,43 +236,42 @@ static ssize_t ad9910_set_parameter(struct device *dev, 
		goto error_ret;

		goto error_ret;

	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->sin_tonep3[0];

	xfer.tx_buf = &config->sin_tonep3[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);

	ret = spi_sync(st->sdev, &msg);

	ret = spi_sync(st->sdev, &msg);

	if (ret)

	if (ret)

		goto error_ret;

		goto error_ret;



	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->sin_tonep4[0];

	xfer.tx_buf = &config->sin_tonep4[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);

	ret = spi_sync(st->sdev, &msg);

	ret = spi_sync(st->sdev, &msg);

	if (ret)

	if (ret)

		goto error_ret;

		goto error_ret;



	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->sin_tonep5[0];

	xfer.tx_buf = &config->sin_tonep5[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);

	ret = spi_sync(st->sdev, &msg);

	ret = spi_sync(st->sdev, &msg);

	if (ret)

	if (ret)

		goto error_ret;

		goto error_ret;



	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->sin_tonep6[0];

	xfer.tx_buf = &config->sin_tonep6[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);

	ret = spi_sync(st->sdev, &msg);

	ret = spi_sync(st->sdev, &msg);

	if (ret)

	if (ret)

		goto error_ret;

		goto error_ret;



	xfer.len = 9;

	xfer.len = 9;

	xfer.tx_buf = &config->sin_tonep7[0];

	xfer.tx_buf = &config->sin_tonep7[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -326,8 +316,6 @@ static void ad9910_init(struct ad9910_state *st) 
	cfr[3] = TX_ENA | PDCLK_INV | PDCLK_ENB;

	cfr[3] = TX_ENA | PDCLK_INV | PDCLK_ENB;

	cfr[4] = PARA_ENA;

	cfr[4] = PARA_ENA;





	mutex_lock(&st->lock);



	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &cfr;

	xfer.tx_buf = &cfr;
@@ -343,8 +331,6 @@ static void ad9910_init(struct ad9910_state *st) 
	cfr[3] = REFCLK_RST | REFCLK_BYP;

	cfr[3] = REFCLK_RST | REFCLK_BYP;

	cfr[4] = 0;

	cfr[4] = 0;





	mutex_lock(&st->lock);



	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &cfr;

	xfer.tx_buf = &cfr;

drivers/staging/iio/dds/ad9951.c

+0 −5
Original line number Original line Diff line number Diff line
@@ -79,7 +79,6 @@ static ssize_t ad9951_set_parameter(struct device *dev, 




	xfer.len = 2;

	xfer.len = 2;

	xfer.tx_buf = &config->arr[0];

	xfer.tx_buf = &config->arr[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -89,7 +88,6 @@ static ssize_t ad9951_set_parameter(struct device *dev, 




	xfer.len = 5;

	xfer.len = 5;

	xfer.tx_buf = &config->ftw0[0];

	xfer.tx_buf = &config->ftw0[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -99,7 +97,6 @@ static ssize_t ad9951_set_parameter(struct device *dev, 




	xfer.len = 3;

	xfer.len = 3;

	xfer.tx_buf = &config->ftw1[0];

	xfer.tx_buf = &config->ftw1[0];

	mutex_lock(&st->lock);





	spi_message_init(&msg);

	spi_message_init(&msg);

	spi_message_add_tail(&xfer, &msg);

	spi_message_add_tail(&xfer, &msg);
@@ -143,8 +140,6 @@ static void ad9951_init(struct ad9951_state *st) 
	cfr[2] = HSPD_SYNC;

	cfr[2] = HSPD_SYNC;

	cfr[3] = 0;

	cfr[3] = 0;





	mutex_lock(&st->lock);



	xfer.len = 4;

	xfer.len = 4;

	xfer.tx_buf = &cfr;

	xfer.tx_buf = &cfr;