Staging: heci: fix spinlock order mess of device_lock and read_io_lock

In orginal code, the device_lock and read_io_lock is mess order when nested,
which may bring dead lock. This patch unify the spinlock order of device_lock
and read_io_lock. First acquire device_lock, then read_io_lock.

Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2 files changed, 16 insertions, 3 deletions

diff --git a/drivers/staging/heci/heci_main.c b/drivers/staging/heci/heci_main.c
index daf1107cb8e0..fb97428b457c 100644
--- a/drivers/staging/heci/heci_main.c
+++ b/drivers/staging/heci/heci_main.c
@@ -954,8 +954,8 @@ static ssize_t heci_read(struct file *file, char __user *ubuf,
                 goto out;
         }
 
-        spin_lock(&file_ext->read_io_lock);
         err = heci_start_read(dev, if_num, file_ext);
+        spin_lock(&file_ext->read_io_lock);
         if (err != 0 && err != -EBUSY) {
                 DBG("heci start read failure with status = %d\n", err);
                 spin_unlock(&file_ext->read_io_lock);
diff --git a/drivers/staging/heci/io_heci.c b/drivers/staging/heci/io_heci.c
index 53dc770727d8..16c723566f6e 100644
--- a/drivers/staging/heci/io_heci.c
+++ b/drivers/staging/heci/io_heci.c
@@ -637,8 +637,9 @@ int heci_start_read(struct iamt_heci_device *dev, int if_num,
                 DBG("received wrong function input param.\n");
                 return -ENODEV;
         }
-        if (file_ext->state != HECI_FILE_CONNECTED)
+        if (file_ext->state != HECI_FILE_CONNECTED) {
                 return -ENODEV;
+        }
 
         spin_lock_bh(&dev->device_lock);
         if (dev->heci_state != HECI_ENABLED) {
@@ -647,18 +648,26 @@ int heci_start_read(struct iamt_heci_device *dev, int if_num,
         }
         spin_unlock_bh(&dev->device_lock);
         DBG("check if read is pending.\n");
+        spin_lock(&file_ext->read_io_lock);
         if ((file_ext->read_pending) || (file_ext->read_cb != NULL)) {
                 DBG("read is pending.\n");
+                spin_unlock(&file_ext->read_io_lock);
                 return -EBUSY;
         }
+        spin_unlock(&file_ext->read_io_lock);
+
         priv_cb = kzalloc(sizeof(struct heci_cb_private), GFP_KERNEL);
         if (!priv_cb)
                 return -ENOMEM;
 
+        spin_lock(&file_ext->read_io_lock);
         DBG("allocation call back success\n"
             "host client = %d, ME client = %d\n",
             file_ext->host_client_id, file_ext->me_client_id);
+        spin_unlock(&file_ext->read_io_lock);
+
         spin_lock_bh(&dev->device_lock);
+        spin_lock(&file_ext->read_io_lock);
         for (i = 0; i < dev->num_heci_me_clients; i++) {
                 if (dev->me_clients[i].client_id == file_ext->me_client_id)
                         break;
@@ -666,6 +675,7 @@ int heci_start_read(struct iamt_heci_device *dev, int if_num,
         }
 
         BUG_ON(dev->me_clients[i].client_id != file_ext->me_client_id);
+        spin_unlock(&file_ext->read_io_lock);
         if (i == dev->num_heci_me_clients) {
                 rets = -ENODEV;
                 goto unlock;
@@ -684,12 +694,14 @@ int heci_start_read(struct iamt_heci_device *dev, int if_num,
         /* make sure information is zero before we start */
         priv_cb->information = 0;
         priv_cb->file_private = (void *) file_ext;
-        file_ext->read_cb = priv_cb;
         spin_lock_bh(&dev->device_lock);
+        spin_lock(&file_ext->read_io_lock);
+        file_ext->read_cb = priv_cb;
         if (dev->host_buffer_is_empty) {
                 dev->host_buffer_is_empty = 0;
                 if (!heci_send_flow_control(dev, file_ext)) {
                         rets = -ENODEV;
+                        spin_unlock(&file_ext->read_io_lock);
                         goto unlock;
                 } else {
                         list_add_tail(&priv_cb->cb_list,
@@ -699,6 +711,7 @@ int heci_start_read(struct iamt_heci_device *dev, int if_num,
                 list_add_tail(&priv_cb->cb_list,
                               &dev->ctrl_wr_list.heci_cb.cb_list);
         }
+        spin_unlock(&file_ext->read_io_lock);
         spin_unlock_bh(&dev->device_lock);
         return rets;
 unlock: