From ae54a287963f420392a715a4d41aebf773f38614 Mon Sep 17 00:00:00 2001 From: David Kershner Date: Wed, 27 Sep 2017 13:14:17 -0400 Subject: [PATCH] staging: unisys: fix up device_destroy Visorbus_remove_instance calls device_unregister which in turn will call visorbus_release_busdevice. The function visorbus_release_busdevice was freeing the visor_device. The code in visorbus_remove_instance was then trying to reference the visor_device. This patch cleans up the code so the visor_device is not referenced after the unregister. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman --- drivers/staging/unisys/visorbus/visorbus_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/staging/unisys/visorbus/visorbus_main.c b/drivers/staging/unisys/visorbus/visorbus_main.c index b35b8a6..aa82508 100644 --- a/drivers/staging/unisys/visorbus/visorbus_main.c +++ b/drivers/staging/unisys/visorbus/visorbus_main.c @@ -181,6 +181,7 @@ static void visorbus_release_busdevice(struct device *xdev) debugfs_remove(dev->debugfs_client_bus_info); debugfs_remove_recursive(dev->debugfs_dir); + visorchannel_destroy(dev->visorchannel); kfree(dev); } @@ -1069,11 +1070,11 @@ void visorbus_remove_instance(struct visor_device *dev) * successfully been able to trace thru the code to see where/how * release() gets called. But I know it does. */ - visorchannel_destroy(dev->visorchannel); kfree(dev->vbus_hdr_info); list_del(&dev->list_all); + if (dev->pending_msg_hdr) + visorbus_response(dev, 0, CONTROLVM_BUS_DESTROY); device_unregister(&dev->device); - visorbus_response(dev, 0, CONTROLVM_BUS_DESTROY); } /* -- 2.7.4