USB: cdc-acm: fix possible deadlock with multiple openers

drivers/usb/class/cdc-acm.c

 /*
  * cdc-acm.c
  *
  * Copyright (c) 1999 Armin Fuerst      <fuerst@in.tum.de>
  * Copyright (c) 1999 Pavel Machek      <pavel@suse.cz>
  * Copyright (c) 1999 Johannes Erdfelt  <johannes@erdfelt.com>
  * Copyright (c) 2000 Vojtech Pavlik    <vojtech@suse.cz>
  * Copyright (c) 2004 Oliver Neukum     <oliver@neukum.name>
  * Copyright (c) 2005 David Kubicek     <dave@awk.cz>
  *
@@ skipping 538 matching lines @@
 {
         struct acm *acm;
         int rv = -ENODEV;
         int i;
         dbg("Entering acm_tty_open.");
 
         mutex_lock(&open_mutex);
 
         acm = acm_table[tty->index];
         if (!acm || !acm->dev)
-                goto err_out;
+                goto out;
         else
                 rv = 0;
 
         set_bit(TTY_NO_WRITE_SPLIT, &tty->flags);
 
         tty->driver_data = acm;
         tty_port_tty_set(&acm->port, tty);
 
         if (usb_autopm_get_interface(acm->control) < 0)
                 goto early_bail;
         else
                 acm->control->needs_remote_wakeup = 1;
 
         mutex_lock(&acm->mutex);
         if (acm->port.count++) {
+                mutex_unlock(&acm->mutex);
                 usb_autopm_put_interface(acm->control);
-                goto done;
+                goto out;
         }
 
         acm->ctrlurb->dev = acm->dev;
         if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
                 dbg("usb_submit_urb(ctrl irq) failed");
                 goto bail_out;
         }
 
         if (0 > acm_set_control(acm, acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS) &&
             (acm->ctrl_caps & USB_CDC_CAP_LINE))
                 goto full_bailout;
 
         usb_autopm_put_interface(acm->control);
 
         INIT_LIST_HEAD(&acm->spare_read_urbs);
         INIT_LIST_HEAD(&acm->spare_read_bufs);
         INIT_LIST_HEAD(&acm->filled_read_bufs);
 
         for (i = 0; i < acm->rx_buflimit; i++)
                 list_add(&(acm->ru[i].list), &acm->spare_read_urbs);
         for (i = 0; i < acm->rx_buflimit; i++)
                 list_add(&(acm->rb[i].list), &acm->spare_read_bufs);
 
         acm->throttle = 0;
 
         set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
         rv = tty_port_block_til_ready(&acm->port, tty, filp);
         tasklet_schedule(&acm->urb_task);
-done:
+
         mutex_unlock(&acm->mutex);
-err_out:
+out:
         mutex_unlock(&open_mutex);
         return rv;
 
 full_bailout:
         usb_kill_urb(acm->ctrlurb);
 bail_out:
-        usb_autopm_put_interface(acm->control);
         acm->port.count--;
         mutex_unlock(&acm->mutex);
+        usb_autopm_put_interface(acm->control);
 early_bail:
         mutex_unlock(&open_mutex);
         tty_port_tty_set(&acm->port, NULL);
         return -EIO;
 }
 
 static void acm_tty_unregister(struct acm *acm)
 {
         int i, nr;
 
@@ skipping 1084 matching lines @@
         put_tty_driver(acm_tty_driver);
 }
 
 module_init(acm_init);
 module_exit(acm_exit);
 
 MODULE_AUTHOR(DRIVER_AUTHOR);
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_CHARDEV_MAJOR(ACM_TTY_MAJOR);