[PATCH] gpib: ni_usb: unlock transfer mutexes before free

[Runyu Xiao]

ni_usb_detach() takes the bulk, control, and interrupt transfer mutexes
before cleaning up the URBs. It then frees ni_priv without releasing them.
Since the mutexes are embedded in ni_priv, freeing the object while they
are held triggers lockdep's "held lock freed!" warning and leaves lockdep's
held-lock state referencing freed memory.

Release the mutexes in reverse acquisition order before freeing ni_priv.
Keep the existing acquisition order and URB cleanup ordering unchanged.

This issue was identified by static analysis and manually confirmed by
tracing the detach path in v7.1.5 and current mainline. A source-level
lifetime check verified that all three transfer mutexes are released before
the private object is freed after this change. The existing GPIB core
detach/lifetime synchronization is not changed by this patch.

Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>
---
 drivers/gpib/ni_usb/ni_usb_gpib.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpib/ni_usb/ni_usb_gpib.c b/drivers/gpib/ni_usb/ni_usb_gpib.c
index 28de1d543ad6..5368076c35e3 100644
--- a/drivers/gpib/ni_usb/ni_usb_gpib.c
+++ b/drivers/gpib/ni_usb/ni_usb_gpib.c
@@ -2377,6 +2377,9 @@ static void ni_usb_detach(struct gpib_board *board)
 		mutex_lock(&ni_priv->control_transfer_lock);
 		mutex_lock(&ni_priv->interrupt_transfer_lock);
 		ni_usb_cleanup_urbs(ni_priv);
+		mutex_unlock(&ni_priv->interrupt_transfer_lock);
+		mutex_unlock(&ni_priv->control_transfer_lock);
+		mutex_unlock(&ni_priv->bulk_transfer_lock);
 		ni_usb_free_private(ni_priv);
 	}
 	mutex_unlock(&ni_usb_hotplug_lock);
-- 
2.34.1