[PATCH 1/5] USB: atm/cxacru, fix lock imbalance

[PATCH 1/5] USB: atm/cxacru, fix lock imbalance

[Jiri Slaby]

We do not hold mutex in one place in cxacru_cm, but unlock it on fail path.
Fix this.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Simon Arlott <cxacru@fire.lp0.eu>
---
 drivers/usb/atm/cxacru.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 5ed4ae0..6789089 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -485,7 +485,7 @@ static int cxacru_cm(struct cxacru_data *instance, enum cxacru_cm_request cm,
 			usb_err(instance->usbatm, "requested transfer size too large (%d, %d)\n",
 				wbuflen, rbuflen);
 		ret = -ENOMEM;
-		goto fail;
+		goto err;
 	}
 
 	mutex_lock(&instance->cm_serialize);
@@ -565,6 +565,7 @@ static int cxacru_cm(struct cxacru_data *instance, enum cxacru_cm_request cm,
 	dbg("cm %#x", cm);
 fail:
 	mutex_unlock(&instance->cm_serialize);
+err:
 	return ret;
 }
 
-- 
1.6.2
caught by stanse

[PATCH 2/5] USB: image/mdc800, fix lock imbalance

[Jiri Slaby]

There is an omitted unlock in mdc800_usb_probe's fail path. Add it.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Henning Zabel <henning@uni-paderborn.de>
---
 drivers/usb/image/mdc800.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/usb/image/mdc800.c b/drivers/usb/image/mdc800.c
index efc075c..eca355d 100644
--- a/drivers/usb/image/mdc800.c
+++ b/drivers/usb/image/mdc800.c
@@ -499,6 +499,7 @@ static int mdc800_usb_probe (struct usb_interface *intf,
 	retval = usb_register_dev(intf, &mdc800_class);
 	if (retval) {
 		dev_err(&intf->dev, "Not able to get a minor for this device.\n");
+		mutex_unlock(&mdc800->io_lock);
 		return -ENODEV;
 	}
 
-- 
1.6.2
caught by stanse

[PATCH 3/5] USB: misc/adutux, fix lock imbalance

[Jiri Slaby]

Don't unlock adutux_mutex when not held.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
---
 drivers/usb/misc/adutux.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index 7b6922e..2035265 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -376,7 +376,7 @@ static int adu_release(struct inode *inode, struct file *file)
 	if (dev->open_count <= 0) {
 		dbg(1," %s : device not opened", __func__);
 		retval = -ENODEV;
-		goto exit;
+		goto unlock;
 	}
 
 	adu_release_internal(dev);
@@ -385,9 +385,9 @@ static int adu_release(struct inode *inode, struct file *file)
 		if (!dev->open_count)	/* ... and we're the last user */
 			adu_delete(dev);
 	}
-
-exit:
+unlock:
 	mutex_unlock(&adutux_mutex);
+exit:
 	dbg(2," %s : leave, return value %d", __func__, retval);
 	return retval;
 }
-- 
1.6.2
caught by stanse

[PATCH 4/5] USB: misc/vstusb, fix lock imbalance

[Jiri Slaby]

Make sure we don't leak locked vstdev->lock in vstusb_write. Unlock
properly on one fail path.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
---
 drivers/usb/misc/vstusb.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/usb/misc/vstusb.c b/drivers/usb/misc/vstusb.c
index 63dff9b..f26ea8d 100644
--- a/drivers/usb/misc/vstusb.c
+++ b/drivers/usb/misc/vstusb.c
@@ -401,6 +401,7 @@ static ssize_t vstusb_write(struct file *file, const char __user *buffer,
 	}
 
 	if (copy_from_user(buf, buffer, count)) {
+		mutex_unlock(&vstdev->lock);
 		dev_err(&dev->dev, "%s: can't copy_from_user\n", __func__);
 		retval = -EFAULT;
 		goto exit;
-- 
1.6.2
caught by stanse

[PATCH 5/5] USB: wusbcore/wa-xfer, fix lock imbalance

[Jiri Slaby]

Fix locking on one wa_urb_enqueue_b's fail path. There was omitted unlock.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
---
 drivers/usb/wusbcore/wa-xfer.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 238a96a..613a5fc 100644
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -921,8 +921,10 @@ static void wa_urb_enqueue_b(struct wa_xfer *xfer)
 	result = -ENODEV;
 	/* FIXME: segmentation broken -- kills DWA */
 	mutex_lock(&wusbhc->mutex);		/* get a WUSB dev */
-	if (urb->dev == NULL)
+	if (urb->dev == NULL) {
+		mutex_unlock(&wusbhc->mutex);
 		goto error_dev_gone;
+	}
 	wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, urb->dev);
 	if (wusb_dev == NULL) {
 		mutex_unlock(&wusbhc->mutex);
-- 
1.6.2
caught by stanse