This patch fixes another disconnect oops in hiddev.
hid-core calls hiddev_disconnect() when the underlying device goes away
(hot unplug or system shutdown). Normally, hiddev_disconnect() will
clean up nicely and return to hid-core who then frees the hid structure.
However, if the corresponding hiddev node is open at disconnect time,
hiddev delays the majority of disconnect work until the device is closed
via hiddev_release(). hiddev_release() calls hiddev_cleanup() which
proceeds to dereference the hid struct which hid-core freed back when
the hardware was disconnected. Oops.
To solve this, we change hiddev_disconnect() to deregister the hiddev
minor and invalidate its table entry immediately and delay only the
freeing of the hiddev structure itself. We're protected against future
operations on the fd since the major fops check hiddev->exists.
There may still be an ordering of events that causes a problem but I can
no longer reproduce any manually. There are enough different subsystems
and object lifetimes interacting here that I may have screwed something
else up; review is certainly welcome.
Signed-off-by: Adam Kropelin <[EMAIL PROTECTED]>
--Adam
--- linux-2.6.7/drivers/usb/input/hiddev.c.orig Mon Jun 21 17:54:58 2004
+++ linux-2.6.7/drivers/usb/input/hiddev.c Mon Jun 21 20:52:58 2004
@@ -226,16 +226,6 @@
return retval < 0 ? retval : 0;
}
-/*
- * De-allocate a hiddev structure
- */
-static struct usb_class_driver hiddev_class;
-static void hiddev_cleanup(struct hiddev *hiddev)
-{
- hiddev_table[hiddev->hid->minor - HIDDEV_MINOR_BASE] = NULL;
- usb_deregister_dev(hiddev->hid->intf, &hiddev_class);
- kfree(hiddev);
-}
/*
* release file op
@@ -256,7 +246,7 @@
if (list->hiddev->exist)
hid_close(list->hiddev->hid);
else
- hiddev_cleanup(list->hiddev);
+ kfree(list->hiddev);
}
kfree(list);
@@ -797,17 +787,21 @@
* This is where hid.c calls us to disconnect a hiddev device from the
* corresponding hid device (usually because the usb device has disconnected)
*/
+static struct usb_class_driver hiddev_class;
void hiddev_disconnect(struct hid_device *hid)
{
struct hiddev *hiddev = hid->hiddev;
hiddev->exist = 0;
+ hiddev_table[hiddev->hid->minor - HIDDEV_MINOR_BASE] = NULL;
+ usb_deregister_dev(hiddev->hid->intf, &hiddev_class);
+
if (hiddev->open) {
hid_close(hiddev->hid);
wake_up_interruptible(&hiddev->wait);
} else {
- hiddev_cleanup(hiddev);
+ kfree(hiddev);
}
}
-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
[EMAIL PROTECTED]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
