aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media/IR
diff options
context:
space:
mode:
authorMauro Carvalho Chehab <mchehab@redhat.com>2010-10-14 12:23:56 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2010-10-21 07:54:01 -0200
commitb4d752b308493b08b51ea04361848ef63d0cad42 (patch)
tree9e74d74471f5a1e80f37c80648e271c5ed2604a1 /drivers/media/IR
parentb784cfcec7293f688b09d3850826216a4e134d2e (diff)
downloadmrst-s0i3-test-b4d752b308493b08b51ea04361848ef63d0cad42.tar.gz
mrst-s0i3-test-b4d752b308493b08b51ea04361848ef63d0cad42.tar.xz
mrst-s0i3-test-b4d752b308493b08b51ea04361848ef63d0cad42.zip
[media] ir: avoid race conditions at device disconnect
It is possible that, while ir_unregister_class() is handling, some application could try to access the sysfs nodes, causing an OOPS. Reviewed-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/IR')
-rw-r--r--drivers/media/IR/ir-sysfs.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/media/IR/ir-sysfs.c b/drivers/media/IR/ir-sysfs.c
index be09d1995b4..186807aa226 100644
--- a/drivers/media/IR/ir-sysfs.c
+++ b/drivers/media/IR/ir-sysfs.c
@@ -68,6 +68,10 @@ static ssize_t show_protocols(struct device *d,
char *tmp = buf;
int i;
+ /* Device is being removed */
+ if (!ir_dev)
+ return -EINVAL;
+
if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
enabled = ir_dev->rc_tab.ir_type;
allowed = ir_dev->props->allowed_protos;
@@ -123,6 +127,10 @@ static ssize_t store_protocols(struct device *d,
int rc, i, count = 0;
unsigned long flags;
+ /* Device is being removed */
+ if (!ir_dev)
+ return -EINVAL;
+
if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
type = ir_dev->rc_tab.ir_type;
else if (ir_dev->raw)
@@ -310,6 +318,7 @@ void ir_unregister_class(struct input_dev *input_dev)
{
struct ir_input_dev *ir_dev = input_get_drvdata(input_dev);
+ input_set_drvdata(input_dev, NULL);
clear_bit(ir_dev->devno, &ir_core_dev_number);
input_unregister_device(input_dev);
device_del(&ir_dev->dev);