USB: fix read vs. disconnect race in cytherm driver
authorOliver Neukum <oliver@neukum.org>
Tue, 23 Oct 2007 10:26:41 +0000 (12:26 +0200)
committerGreg Kroah-Hartman <gregkh@suse.de>
Thu, 25 Oct 2007 19:18:44 +0000 (12:18 -0700)
the disconnect method of this driver set intfdata to NULL before
removing attribute files. The attributes' read methods will happily
follow the NULL pointer. Here's the correct ordering.

Signed-off-by : Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/misc/cytherm.c

index 2677fea..1cd9e7e 100644 (file)
@@ -399,7 +399,6 @@ static void cytherm_disconnect(struct usb_interface *interface)
        struct usb_cytherm *dev;
 
        dev = usb_get_intfdata (interface);
-       usb_set_intfdata (interface, NULL);
 
        device_remove_file(&interface->dev, &dev_attr_brightness);
        device_remove_file(&interface->dev, &dev_attr_temp);
@@ -407,6 +406,9 @@ static void cytherm_disconnect(struct usb_interface *interface)
        device_remove_file(&interface->dev, &dev_attr_port0);
        device_remove_file(&interface->dev, &dev_attr_port1);
 
+       /* first remove the files, then NULL the pointer */
+       usb_set_intfdata (interface, NULL);
+
        usb_put_dev(dev->udev);
 
        kfree(dev);