From: Bruno Prémont Date: Sun, 19 Aug 2012 17:31:23 +0000 (+0200) Subject: HID: picoLCD: prevent NULL pointer dereferences X-Git-Tag: v3.7-rc1~202^2~2^4~11 X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=a5785cc0101928663c8ed89f42afea719aecee09;p=~emulex%2Finfiniband.git HID: picoLCD: prevent NULL pointer dereferences Driver code expects to get access to struct picolcd_data from hiddev and is not prepared to find a NULL pointer there. Most prominent candidate to trip on it is picolcd_fb_deferred_io(). Delay removing struct picolcd_data from hiddev until all sub-devices have been unregistered. Signed-off-by: Bruno Prémont Signed-off-by: Jiri Kosina --- diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c index 2d7ef688d66..e4fe342e7aa 100644 --- a/drivers/hid/hid-picolcd_core.c +++ b/drivers/hid/hid-picolcd_core.c @@ -653,7 +653,6 @@ static void picolcd_remove(struct hid_device *hdev) device_remove_file(&hdev->dev, &dev_attr_operation_mode_delay); hid_hw_close(hdev); hid_hw_stop(hdev); - hid_set_drvdata(hdev, NULL); /* Shortcut potential pending reply that will never arrive */ spin_lock_irqsave(&data->lock, flags); @@ -671,6 +670,7 @@ static void picolcd_remove(struct hid_device *hdev) picolcd_exit_cir(data); picolcd_exit_keys(data); + hid_set_drvdata(hdev, NULL); mutex_destroy(&data->mutex); /* Finally, clean up the picolcd data itself */ kfree(data);