3 files changed, 18 insertions, 15 deletions

diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index ed03234cbea8..40cc9732dc28 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -27,6 +27,7 @@
 #include <linux/poll.h>
 #include <linux/preempt.h>
 #include <linux/time.h>
+#include <linux/spinlock.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
 #include <linux/idr.h>
@@ -132,9 +133,9 @@ static int fw_device_op_open(struct inode *inode, struct file *file)
 
         file->private_data = client;
 
-        spin_lock_irqsave(&device->card->lock, flags);
+        spin_lock_irqsave(&device->client_list_lock, flags);
         list_add_tail(&client->link, &device->client_list);
-        spin_unlock_irqrestore(&device->card->lock, flags);
+        spin_unlock_irqrestore(&device->client_list_lock, flags);
 
         return 0;
 }
@@ -205,12 +206,14 @@ fw_device_op_read(struct file *file,
         return dequeue_event(client, buffer, count);
 }
 
-/* caller must hold card->lock so that node pointers can be dereferenced here */
 static void
 fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
                      struct client *client)
 {
         struct fw_card *card = client->device->card;
+        unsigned long flags;
+
+        spin_lock_irqsave(&card->lock, flags);
 
         event->closure       = client->bus_reset_closure;
         event->type          = FW_CDEV_EVENT_BUS_RESET;
@@ -220,22 +223,23 @@ fill_bus_reset_event(struct fw_cdev_event_bus_reset *event,
         event->bm_node_id    = 0; /* FIXME: We don't track the BM. */
         event->irm_node_id   = card->irm_node->node_id;
         event->root_node_id  = card->root_node->node_id;
+
+        spin_unlock_irqrestore(&card->lock, flags);
 }
 
 static void
 for_each_client(struct fw_device *device,
                 void (*callback)(struct client *client))
 {
-        struct fw_card *card = device->card;
         struct client *c;
         unsigned long flags;
 
-        spin_lock_irqsave(&card->lock, flags);
+        spin_lock_irqsave(&device->client_list_lock, flags);
 
         list_for_each_entry(c, &device->client_list, link)
                 callback(c);
 
-        spin_unlock_irqrestore(&card->lock, flags);
+        spin_unlock_irqrestore(&device->client_list_lock, flags);
 }
 
 static void
@@ -274,11 +278,11 @@ static int ioctl_get_info(struct client *client, void *buffer)
 {
         struct fw_cdev_get_info *get_info = buffer;
         struct fw_cdev_event_bus_reset bus_reset;
-        struct fw_card *card = client->device->card;
         unsigned long ret = 0;
 
         client->version = get_info->version;
         get_info->version = FW_CDEV_VERSION;
+        get_info->card = client->device->card->index;
 
         down_read(&fw_device_rwsem);
 
@@ -300,18 +304,12 @@ static int ioctl_get_info(struct client *client, void *buffer)
         client->bus_reset_closure = get_info->bus_reset_closure;
         if (get_info->bus_reset != 0) {
                 void __user *uptr = u64_to_uptr(get_info->bus_reset);
-                unsigned long flags;
 
-                spin_lock_irqsave(&card->lock, flags);
                 fill_bus_reset_event(&bus_reset, client);
-                spin_unlock_irqrestore(&card->lock, flags);
-
                 if (copy_to_user(uptr, &bus_reset, sizeof(bus_reset)))
                         return -EFAULT;
         }
 
-        get_info->card = card->index;
-
         return 0;
 }
 
@@ -1009,9 +1007,9 @@ static int fw_device_op_release(struct inode *inode, struct file *file)
         list_for_each_entry_safe(e, next_e, &client->event_list, link)
                 kfree(e);
 
-        spin_lock_irqsave(&client->device->card->lock, flags);
+        spin_lock_irqsave(&client->device->client_list_lock, flags);
         list_del(&client->link);
-        spin_unlock_irqrestore(&client->device->card->lock, flags);
+        spin_unlock_irqrestore(&client->device->client_list_lock, flags);
 
         fw_device_put(client->device);
         kfree(client);
diff --git a/drivers/firewire/fw-device.c b/drivers/firewire/fw-device.c
index bf53acb45652..ffde1bed46b2 100644
--- a/drivers/firewire/fw-device.c
+++ b/drivers/firewire/fw-device.c
@@ -29,6 +29,7 @@
 #include <linux/string.h>
 #include <linux/rwsem.h>
 #include <linux/semaphore.h>
+#include <linux/spinlock.h>
 #include <asm/system.h>
 #include <linux/ctype.h>
 #include "fw-transaction.h"
@@ -1004,6 +1005,7 @@ void fw_node_event(struct fw_card *card, struct fw_node *node, int event)
                 device->node = fw_node_get(node);
                 device->node_id = node->node_id;
                 device->generation = card->generation;
+                spin_lock_init(&device->client_list_lock);
                 INIT_LIST_HEAD(&device->client_list);
 
                 /*
diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
index 8ef6ec2ca21c..008a7908a865 100644
--- a/drivers/firewire/fw-device.h
+++ b/drivers/firewire/fw-device.h
@@ -23,6 +23,7 @@
 #include <linux/cdev.h>
 #include <linux/idr.h>
 #include <linux/rwsem.h>
+#include <linux/spinlock.h>
 #include <asm/atomic.h>
 
 enum fw_device_state {
@@ -64,6 +65,8 @@ struct fw_device {
         bool cmc;
         struct fw_card *card;
         struct device device;
+        /* to prevent deadlocks, never take this lock with card->lock held */
+        spinlock_t client_list_lock;
         struct list_head client_list;
         u32 *config_rom;
         size_t config_rom_length;