Am Freitag, 24. November 2006 18:44 schrieb Alan Stern:
> On Fri, 24 Nov 2006, Oliver Neukum wrote:
>
> > --- drivers/usb/misc/trancevibrator.c~ 2006-11-16 05:03:40.000000000
> > +0100
> > +++ drivers/usb/misc/trancevibrator.c 2006-11-24 12:30:29.000000000
> > +0100
> > @@ -120,8 +120,8 @@
> > struct trancevibrator *dev;
> >
> > dev = usb_get_intfdata (interface);
> > - usb_set_intfdata(interface, NULL);
> > device_remove_file(&interface->dev, &dev_attr_speed);
> > + usb_set_intfdata(interface, NULL);
> > usb_put_dev(dev->udev);
> > kfree(dev);
> > }
>
> By the way, you should be aware that creating an attribute file in the
> interface's device directory (like dev_attr_speed above) is inherently
> unsafe. A user process can open the file, hold it open while the driver
> is unloaded, and then try to read or write it -- causing an oops.
That's bad.
In fact I don't trust the semantics of device_remove_file(), but even if it
has the semantics here assumed the driver is still buggy and therefore
I fixed it.
Wild idea: How about setting struct subsys_attribute * to NULL and react in
fill_read_buffer() ?
Regards
Oliver
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
