[media] s5p-fimc: Fix bug in capture node open()

When video pipeline initialization fails, the ST_CAPT_BUSY flag
needs to be cleared before pm_runtime_put_sync is called.
Otherwise the runtime suspend routine tries to suspend device,
rather than just turning it off. Also fix potential null pointer
dereference in fimc_pipeline_shutdown().

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

2 files changed, 6 insertions, 2 deletions

diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index 354574591908..7083107c2b37 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -499,10 +499,10 @@ static int fimc_capture_open(struct file *file)
                 if (ret < 0) {
                         dev_err(&fimc->pdev->dev,
                                 "Video pipeline initialization failed\n");
+                        clear_bit(ST_CAPT_BUSY, &fimc->state);
                         pm_runtime_put_sync(&fimc->pdev->dev);
                         fimc->vid_cap.refcnt--;
                         v4l2_fh_release(file);
-                        clear_bit(ST_CAPT_BUSY, &fimc->state);
                         return ret;
                 }
                 ret = fimc_capture_ctrls_create(fimc);
diff --git a/drivers/media/video/s5p-fimc/fimc-mdevice.c b/drivers/media/video/s5p-fimc/fimc-mdevice.c
index 6753c45631b8..7450dcdafc87 100644
--- a/drivers/media/video/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/video/s5p-fimc/fimc-mdevice.c
@@ -193,9 +193,13 @@ int __fimc_pipeline_shutdown(struct fimc_pipeline *p)
 
 int fimc_pipeline_shutdown(struct fimc_pipeline *p)
 {
-        struct media_entity *me = &p->subdevs[IDX_SENSOR]->entity;
+        struct media_entity *me;
         int ret;
 
+        if (!p || !p->subdevs[IDX_SENSOR])
+                return -EINVAL;
+
+        me = &p->subdevs[IDX_SENSOR]->entity;
         mutex_lock(&me->parent->graph_mutex);
         ret = __fimc_pipeline_shutdown(p);
         mutex_unlock(&me->parent->graph_mutex);