Index: cpukit/ChangeLog
===================================================================
--- cpukit/ChangeLog	(revision dc927fe9f8ce04c352ac2a802c878b9da67b1e8a)
+++ cpukit/ChangeLog	(revision 8774fddf30cd8955b69fd4eb90862c3101cc659a)
@@ -1,2 +1,11 @@
+2009-05-28	Joel Sherrill <joel.sherrill@OARcorp.com>
+
+	PR 1415/cpukit
+	* rtems/src/semcreate.c, rtems/src/semtranslatereturncode.c,
+	score/include/rtems/score/coremutex.h,
+	score/inline/rtems/score/coremutex.inl, score/src/coremutex.c:
+	Address two paths where a task with a priority above the ceiling
+	could obtain a priority ceiling mutex.
+
 2009-05-21	Joel Sherrill <joel.sherrill@OARcorp.com>
 
Index: cpukit/rtems/src/semcreate.c
===================================================================
--- cpukit/rtems/src/semcreate.c	(revision dc927fe9f8ce04c352ac2a802c878b9da67b1e8a)
+++ cpukit/rtems/src/semcreate.c	(revision 8774fddf30cd8955b69fd4eb90862c3101cc659a)
@@ -81,5 +81,4 @@
   CORE_mutex_Attributes       the_mutex_attributes;
   CORE_semaphore_Attributes   the_semaphore_attributes;
-  uint32_t                    lock;
 
   if ( !rtems_is_name_valid( name ) )
@@ -147,4 +146,6 @@
 
   if ( !_Attributes_Is_counting_semaphore( attribute_set ) ) {
+    CORE_mutex_Status mutex_status;
+
     if ( _Attributes_Is_inherit_priority( attribute_set ) )
       the_mutex_attributes.discipline = CORE_MUTEX_DISCIPLINES_PRIORITY_INHERIT;
@@ -177,14 +178,15 @@
     the_mutex_attributes.priority_ceiling = priority_ceiling;
 
-    if ( count == 1 )
-      lock = CORE_MUTEX_UNLOCKED;
-    else
-      lock = CORE_MUTEX_LOCKED;
-
-    _CORE_mutex_Initialize(
+    mutex_status = _CORE_mutex_Initialize(
       &the_semaphore->Core_control.mutex,
       &the_mutex_attributes,
-      lock
-    );
+      (count == 1) ? CORE_MUTEX_UNLOCKED : CORE_MUTEX_LOCKED
+     ); 
+
+     if ( mutex_status == CORE_MUTEX_STATUS_CEILING_VIOLATED ) {
+       _Semaphore_Free( the_semaphore );
+       _Thread_Enable_dispatch();
+       return RTEMS_INVALID_PRIORITY;
+     }
   } else {
     if ( _Attributes_Is_priority( attribute_set ) )
Index: cpukit/rtems/src/semtranslatereturncode.c
===================================================================
--- cpukit/rtems/src/semtranslatereturncode.c	(revision dc927fe9f8ce04c352ac2a802c878b9da67b1e8a)
+++ cpukit/rtems/src/semtranslatereturncode.c	(revision 8774fddf30cd8955b69fd4eb90862c3101cc659a)
@@ -16,5 +16,5 @@
  *     + release a semaphore
  *
- *  COPYRIGHT (c) 1989-1999.
+ *  COPYRIGHT (c) 1989-2008.
  *  On-Line Applications Research Corporation (OAR).
  *
@@ -69,5 +69,5 @@
   RTEMS_OBJECT_WAS_DELETED, /* CORE_MUTEX_WAS_DELETED */
   RTEMS_TIMEOUT,            /* CORE_MUTEX_TIMEOUT */
-  RTEMS_INTERNAL_ERROR,     /* CORE_MUTEX_STATUS_CEILING_VIOLATED */
+  RTEMS_INVALID_PRIORITY    /* CORE_MUTEX_STATUS_CEILING_VIOLATED */
 };
 
Index: cpukit/score/include/rtems/score/coremutex.h
===================================================================
--- cpukit/score/include/rtems/score/coremutex.h	(revision dc927fe9f8ce04c352ac2a802c878b9da67b1e8a)
+++ cpukit/score/include/rtems/score/coremutex.h	(revision 8774fddf30cd8955b69fd4eb90862c3101cc659a)
@@ -9,5 +9,5 @@
 
 /*
- *  COPYRIGHT (c) 1989-2006.
+ *  COPYRIGHT (c) 1989-2009.
  *  On-Line Applications Research Corporation (OAR).
  *
@@ -217,6 +217,8 @@
  *         mutex instance
  *  @param[in] initial_lock is the initial value of the mutex
- */
-void _CORE_mutex_Initialize(
+ *
+ *  @return This method returns CORE_MUTEX_STATUS_SUCCESSFUL if successful.
+ */
+CORE_mutex_Status _CORE_mutex_Initialize(
   CORE_mutex_Control           *the_mutex,
   CORE_mutex_Attributes        *the_mutex_attributes,
Index: cpukit/score/inline/rtems/score/coremutex.inl
===================================================================
--- cpukit/score/inline/rtems/score/coremutex.inl	(revision dc927fe9f8ce04c352ac2a802c878b9da67b1e8a)
+++ cpukit/score/inline/rtems/score/coremutex.inl	(revision 8774fddf30cd8955b69fd4eb90862c3101cc659a)
@@ -7,5 +7,5 @@
 
 /*
- *  COPYRIGHT (c) 1989-2006.
+ *  COPYRIGHT (c) 1989-2009.
  *  On-Line Applications Research Corporation (OAR).
  *
@@ -173,4 +173,5 @@
       /* if ( current < ceiling ) */ {
         executing->Wait.return_code = CORE_MUTEX_STATUS_CEILING_VIOLATED;
+        the_mutex->lock       = CORE_MUTEX_UNLOCKED;
         the_mutex->nest_count = 0;     /* undo locking above */
         executing->resource_count--;   /* undo locking above */
Index: cpukit/score/src/coremutex.c
===================================================================
--- cpukit/score/src/coremutex.c	(revision dc927fe9f8ce04c352ac2a802c878b9da67b1e8a)
+++ cpukit/score/src/coremutex.c	(revision 8774fddf30cd8955b69fd4eb90862c3101cc659a)
@@ -7,5 +7,5 @@
  *  This handler provides synchronization and mutual exclusion capabilities.
  *
- *  COPYRIGHT (c) 1989-1999.
+ *  COPYRIGHT (c) 1989-2009.
  *  On-Line Applications Research Corporation (OAR).
  *
@@ -43,5 +43,5 @@
  */
 
-void _CORE_mutex_Initialize(
+CORE_mutex_Status _CORE_mutex_Initialize(
   CORE_mutex_Control           *the_mutex,
   CORE_mutex_Attributes        *the_mutex_attributes,
@@ -65,4 +65,7 @@
     if ( _CORE_mutex_Is_inherit_priority( &the_mutex->Attributes ) ||
          _CORE_mutex_Is_priority_ceiling( &the_mutex->Attributes ) )
+       if ( _Thread_Executing->current_priority < 
+              the_mutex->Attributes.priority_ceiling )
+        return CORE_MUTEX_STATUS_CEILING_VIOLATED;
       _Thread_Executing->resource_count++;
   } else {
@@ -79,3 +82,5 @@
     CORE_MUTEX_TIMEOUT
   );
+
+  return CORE_MUTEX_STATUS_SUCCESSFUL;
 }
