From: Julia Lawall on
From: Julia Lawall <julia(a)>

The path around the loop ends with the lock held, so the call to mutex_lock
is moved before the beginning of the loop.

A simplified version of the semantic match that finds this problem is as
follows: (

// <smpl>
expression E1;
position p;


@r exists@
expression x <= locked.E1;
expression locked.E1;
expression E2;
identifier lock;
position locked.p,p1,p2;

*lock(a)p1 (E1@p,...);
.... when != E1
when != \(x = E2\|&x\)
*lock(a)p2 (E1,...);
// </smpl>

Signed-off-by: Julia Lawall <julia(a)>

Compile tested only.

drivers/hid/hid-debug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index c940267..850d02a 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -949,8 +949,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer,
int ret = 0, len;
DECLARE_WAITQUEUE(wait, current);

+ mutex_lock(&list->read_mutex);
while (ret == 0) {
- mutex_lock(&list->read_mutex);
if (list->head == list->tail) {
add_wait_queue(&list->hdev->debug_wait, &wait);
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)
More majordomo info at
Please read the FAQ at