1 files changed, 13 insertions, 6 deletions

diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 2833fd772a24..e5e0cfed5e3b 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -228,7 +228,6 @@ static int spidev_message(struct spidev_data *spidev,
          * We walk the array of user-provided transfers, using each one
          * to initialize a kernel version of the same transfer.
          */
-        mutex_lock(&spidev->buf_lock);
         buf = spidev->buffer;
         total = 0;
         for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers;
@@ -296,14 +295,12 @@ static int spidev_message(struct spidev_data *spidev,
         status = total;
 
 done:
-        mutex_unlock(&spidev->buf_lock);
         kfree(k_xfers);
         return status;
 }
 
-static int
-spidev_ioctl(struct inode *inode, struct file *filp,
-                unsigned int cmd, unsigned long arg)
+static long
+spidev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         int                     err = 0;
         int                     retval = 0;
@@ -341,6 +338,14 @@ spidev_ioctl(struct inode *inode, struct file *filp,
         if (spi == NULL)
                 return -ESHUTDOWN;
 
+        /* use the buffer lock here for triple duty:
+         *  - prevent I/O (from us) so calling spi_setup() is safe;
+         *  - prevent concurrent SPI_IOC_WR_* from morphing
+         *    data fields while SPI_IOC_RD_* reads them;
+         *  - SPI_IOC_MESSAGE needs the buffer locked "normally".
+         */
+        mutex_lock(&spidev->buf_lock);
+
         switch (cmd) {
         /* read requests */
         case SPI_IOC_RD_MODE:
@@ -456,6 +461,8 @@ spidev_ioctl(struct inode *inode, struct file *filp,
                 kfree(ioc);
                 break;
         }
+
+        mutex_unlock(&spidev->buf_lock);
         spi_dev_put(spi);
         return retval;
 }
@@ -533,7 +540,7 @@ static struct file_operations spidev_fops = {
          */
         .write =        spidev_write,
         .read =         spidev_read,
-        .ioctl =        spidev_ioctl,
+        .unlocked_ioctl = spidev_ioctl,
         .open =         spidev_open,
         .release =      spidev_release,
 };