[PATCH] gpib: agilent_82357a: unlock allocation mutexes before free

agilent_82357a_detach() takes the control, bulk, and interrupt allocation
mutexes before cleaning up the URBs. It then frees a_priv without releasing
them. Since the mutexes are embedded in a_priv, freeing the object while
they are held triggers lockdep's "held lock freed!" warning and leaves
lockdep's held-lock state referencing freed memory.

Release the mutexes in reverse acquisition order before freeing a_priv.
Keep the existing acquisition order so the detach synchronization with
concurrent USB operations is unchanged.

This issue was identified by static analysis and manually confirmed by
tracing the detach path in v7.1.5 and current mainline. A source-level
lifetime check verified that all three allocation mutexes are released
before the private object is freed after this change.

Fixes: 4c41fe886a56 ("staging: gpib: Add Agilent/Keysight 82357x USB GPIB driver")
Cc: [email protected]
Signed-off-by: Runyu Xiao <[email protected]>
---
 drivers/gpib/agilent_82357a/agilent_82357a.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpib/agilent_82357a/agilent_82357a.c b/drivers/gpib/agilent_82357a/agilent_82357a.c
index 2468a471d175..25093bfe6638 100644
--- a/drivers/gpib/agilent_82357a/agilent_82357a.c
+++ b/drivers/gpib/agilent_82357a/agilent_82357a.c
@@ -1426,6 +1426,9 @@ static void agilent_82357a_detach(struct gpib_board *board)
 		mutex_lock(&a_priv->interrupt_alloc_lock);
 		agilent_82357a_cleanup_urbs(a_priv);
 		agilent_82357a_release_urbs(a_priv);
+		mutex_unlock(&a_priv->interrupt_alloc_lock);
+		mutex_unlock(&a_priv->bulk_alloc_lock);
+		mutex_unlock(&a_priv->control_alloc_lock);
 		agilent_82357a_free_private(board);
 	}
 	mutex_unlock(&agilent_82357a_hotplug_lock);
-- 
2.34.1