[media] s5p-fimc: Fix bug in capture node open()

When video pipeline initialization fails, the ST_CAPT_BUSY flag
needs to be cleared before pm_runtime_put_sync is called.
Otherwise the runtime suspend routine tries to suspend device,
rather than just turning it off. Also fix potential null pointer
dereference in fimc_pipeline_shutdown().

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index 3545745..7083107 100644 (file)
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -499,10 +499,10 @@ static int fimc_capture_open(struct file *file)
                if (ret < 0) {
                        dev_err(&fimc->pdev->dev,
                                "Video pipeline initialization failed\n");
+                       clear_bit(ST_CAPT_BUSY, &fimc->state);
                        pm_runtime_put_sync(&fimc->pdev->dev);
                        fimc->vid_cap.refcnt--;
                        v4l2_fh_release(file);
-                       clear_bit(ST_CAPT_BUSY, &fimc->state);
                        return ret;
                }
                ret = fimc_capture_ctrls_create(fimc);

diff --git a/drivers/media/video/s5p-fimc/fimc-mdevice.c b/drivers/media/video/s5p-fimc/fimc-mdevice.c
index 6753c45..7450dcd 100644 (file)
--- a/drivers/media/video/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/video/s5p-fimc/fimc-mdevice.c
@@ -193,9 +193,13 @@ int __fimc_pipeline_shutdown(struct fimc_pipeline *p)
 
 int fimc_pipeline_shutdown(struct fimc_pipeline *p)
 {
-       struct media_entity *me = &p->subdevs[IDX_SENSOR]->entity;
+       struct media_entity *me;
        int ret;
 
+       if (!p || !p->subdevs[IDX_SENSOR])
+               return -EINVAL;
+
+       me = &p->subdevs[IDX_SENSOR]->entity;
        mutex_lock(&me->parent->graph_mutex);
        ret = __fimc_pipeline_shutdown(p);
        mutex_unlock(&me->parent->graph_mutex);