--- drivers/staging/usbip/vhci_rx.c

+++ drivers/staging/usbip/vhci_rx.c

@@ -21,16 +21,14 @@

#include "vhci.h"

-/* get URB from transmitted urb queue */

-static struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,

+/* get URB from transmitted urb queue. caller must hold vdev->priv_lock */

+struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,

__u32 seqnum)

{

struct vhci_priv *priv, *tmp;

struct urb *urb = NULL;

int status;

- spin_lock(&vdev->priv_lock);

-

list_for_each_entry_safe(priv, tmp, &vdev->priv_rx, list) {

if (priv->seqnum == seqnum) {

urb = priv->urb;

@@ -61,8 +59,6 @@ static struct urb *pickup_urb_and_free_p

}

}

- spin_unlock(&vdev->priv_lock);

-

return urb;

}

@@ -72,9 +68,11 @@ static void vhci_recv_ret_submit(struct

struct usbip_device *ud = &vdev->ud;

struct urb *urb;

+ spin_lock(&vdev->priv_lock);

urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum);

+ spin_unlock(&vdev->priv_lock);

if (!urb) {

usbip_uerr("cannot find a urb of seqnum %u\n",

@@ -159,7 +157,12 @@ static void vhci_recv_ret_unlink(struct

return;

}

+ spin_lock(&vdev->priv_lock);

+

urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);

+

+ spin_unlock(&vdev->priv_lock);

+

if (!urb) {

/*

* I get the result of a unlink request. But, it seems that I