提交 bfd3a5a9 编写于 作者: G Greg Kroah-Hartman

USB: Phidget: fix race in device_create

There is a race from when a device is created with device_create() and
then the drvdata is set with a call to dev_set_drvdata() in which a
sysfs file could be open, yet the drvdata will be NULL, causing all
sorts of bad things to happen.

This patch fixes the problem by using the new function,
device_create_drvdata().  It fixes all 3 phidget drivers, which all have
the same problem.

Cc: Kay Sievers <kay.sievers@vrfy.org>
Cc: Sean Young <sean@mess.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
上级 c5fb920a
...@@ -595,14 +595,14 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic ...@@ -595,14 +595,14 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
} while(value); } while(value);
kit->dev_no = bit; kit->dev_no = bit;
kit->dev = device_create(phidget_class, &kit->udev->dev, 0, kit->dev = device_create_drvdata(phidget_class, &kit->udev->dev,
MKDEV(0, 0), kit,
"interfacekit%d", kit->dev_no); "interfacekit%d", kit->dev_no);
if (IS_ERR(kit->dev)) { if (IS_ERR(kit->dev)) {
rc = PTR_ERR(kit->dev); rc = PTR_ERR(kit->dev);
kit->dev = NULL; kit->dev = NULL;
goto out; goto out;
} }
dev_set_drvdata(kit->dev, kit);
if (usb_submit_urb(kit->irq, GFP_KERNEL)) { if (usb_submit_urb(kit->irq, GFP_KERNEL)) {
rc = -EIO; rc = -EIO;
......
...@@ -365,7 +365,8 @@ static int motorcontrol_probe(struct usb_interface *intf, const struct usb_devic ...@@ -365,7 +365,8 @@ static int motorcontrol_probe(struct usb_interface *intf, const struct usb_devic
} while(value); } while(value);
mc->dev_no = bit; mc->dev_no = bit;
mc->dev = device_create(phidget_class, &mc->udev->dev, 0, mc->dev = device_create_drvdata(phidget_class, &mc->udev->dev,
MKDEV(0, 0), mc,
"motorcontrol%d", mc->dev_no); "motorcontrol%d", mc->dev_no);
if (IS_ERR(mc->dev)) { if (IS_ERR(mc->dev)) {
rc = PTR_ERR(mc->dev); rc = PTR_ERR(mc->dev);
...@@ -373,8 +374,6 @@ static int motorcontrol_probe(struct usb_interface *intf, const struct usb_devic ...@@ -373,8 +374,6 @@ static int motorcontrol_probe(struct usb_interface *intf, const struct usb_devic
goto out; goto out;
} }
dev_set_drvdata(mc->dev, mc);
if (usb_submit_urb(mc->irq, GFP_KERNEL)) { if (usb_submit_urb(mc->irq, GFP_KERNEL)) {
rc = -EIO; rc = -EIO;
goto out; goto out;
......
...@@ -275,14 +275,14 @@ servo_probe(struct usb_interface *interface, const struct usb_device_id *id) ...@@ -275,14 +275,14 @@ servo_probe(struct usb_interface *interface, const struct usb_device_id *id)
} while (value); } while (value);
dev->dev_no = bit; dev->dev_no = bit;
dev->dev = device_create(phidget_class, &dev->udev->dev, 0, dev->dev = device_create_drvdata(phidget_class, &dev->udev->dev,
MKDEV(0, 0), dev,
"servo%d", dev->dev_no); "servo%d", dev->dev_no);
if (IS_ERR(dev->dev)) { if (IS_ERR(dev->dev)) {
rc = PTR_ERR(dev->dev); rc = PTR_ERR(dev->dev);
dev->dev = NULL; dev->dev = NULL;
goto out; goto out;
} }
dev_set_drvdata(dev->dev, dev);
servo_count = dev->type & SERVO_COUNT_QUAD ? 4 : 1; servo_count = dev->type & SERVO_COUNT_QUAD ? 4 : 1;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册