[PATCH] USB: fix for open/disconnect race in acm

open takes the semaphore too late. This fixes it.
Signed-off-by: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

drivers/usb/class/cdc-acm.c

@@ -261,16 +261,22 @@ static void acm_softint(void *private)
 
 static int acm_tty_open(struct tty_struct *tty, struct file *filp)
 {
-	struct acm *acm = acm_table[tty->index];
+	struct acm *acm;
+	int rv = -EINVAL;
 	dbg("Entering acm_tty_open.\n");
+	
+	down(&open_sem);
 
+	acm = acm_table[tty->index];
 	if (!acm || !acm->dev)
-		return -EINVAL;
+		goto err_out;
+	else
+		rv = 0;
 
 	tty->driver_data = acm;
 	acm->tty = tty;
 
-        down(&open_sem);
+
 
 	if (acm->used) {
 		goto done;
@@ -279,7 +285,8 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
 	acm->ctrlurb->dev = acm->dev;
 	if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
 		dbg("usb_submit_urb(ctrl irq) failed");
-		goto bail_out;
+		rv = -EIO;
+		goto err_out;
 	}
 
 	acm->readurb->dev = acm->dev;
@@ -297,14 +304,14 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
 
 done:
 	acm->used++;
+err_out:
 	up(&open_sem);
-	return 0;
+	return rv;
 
 full_bailout:
 	usb_kill_urb(acm->readurb);
 bail_out_and_unlink:
 	usb_kill_urb(acm->ctrlurb);
-bail_out:
 	up(&open_sem);
 	return -EIO;
 }