Hi Dan,

On 09/01/16 03:47, Michal Nazarewicz wrote:
> From: Dan Carpenter <dan.carpenter@oracle.com>
> 
> We added a new error path to this function and we forgot to drop the
> lock.
> 
> Fixes: e1e3d7ec5da3 ('usb: gadget: f_midi: pre-allocate IN requests')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> [mina86@mina86.com: rebased on top of refactoring commit]
> Signed-off-by: Michal Nazarewicz <mina86@mina86.com>

Reviewed-by: Felipe F. Tonello <eu@felipetonello.com>

> ---
>  drivers/usb/gadget/function/f_midi.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
> index fd67af2..f287c68 100644
> --- a/drivers/usb/gadget/function/f_midi.c
> +++ b/drivers/usb/gadget/function/f_midi.c
> @@ -1098,7 +1098,7 @@ static void f_midi_unbind(struct usb_configuration *c, struct usb_function *f)
>  
>  static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  {
> -	struct f_midi *midi;
> +	struct f_midi *midi = NULL;
>  	struct f_midi_opts *opts;
>  	int status, i;
>  
> @@ -1107,8 +1107,8 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  	mutex_lock(&opts->lock);
>  	/* sanity check */
>  	if (opts->in_ports > MAX_PORTS || opts->out_ports > MAX_PORTS) {
> -		mutex_unlock(&opts->lock);
> -		return ERR_PTR(-EINVAL);
> +		status = -EINVAL;
> +		goto setup_fail;
>  	}
>  
>  	/* allocate and initialize one new instance */
> @@ -1116,8 +1116,8 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  		sizeof(*midi) + opts->in_ports * sizeof(*midi->in_ports_array),
>  		GFP_KERNEL);
>  	if (!midi) {
> -		mutex_unlock(&opts->lock);
> -		return ERR_PTR(-ENOMEM);
> +		status = -ENOMEM;
> +		goto setup_fail;
>  	}
>  
>  	for (i = 0; i < opts->in_ports; i++)
> @@ -1127,7 +1127,6 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  	midi->id = kstrdup(opts->id, GFP_KERNEL);
>  	if (opts->id && !midi->id) {
>  		status = -ENOMEM;
> -		mutex_unlock(&opts->lock);
>  		goto setup_fail;
>  	}
>  	midi->in_ports = opts->in_ports;
> @@ -1148,6 +1147,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
>  	return &midi->func;
>  
>  setup_fail:
> +	mutex_unlock(&opts->lock);
>  	kfree(midi);
>  	return ERR_PTR(status);
>  }
>