From: Valentine Barshak Date: Mon, 6 Dec 2010 14:51:41 +0000 (+0300) Subject: HID: Fix race between disconnect and hiddev_ioctl X-Git-Tag: v2.6.38-rc1~442^2~20 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1a8e8fab790ea7af81b8f964fdec706ad1ec2271;p=pandora-kernel.git HID: Fix race between disconnect and hiddev_ioctl A USB HID device can be disconnected at any time. If this happens right before or while hiddev_ioctl is in progress, the hiddev_ioctl tries to access invalid hiddev->hid pointer. When the hid device is disconnected, the hiddev_disconnect() ends up with a call to hid_device_release() which frees hid_device, but doesn't set the hiddev->hid pointer to NULL. If the deallocated memory region has been re-used by the kernel, this can cause a crash or memory corruption. Since disconnect can happen at any time, we can't initialize struct hid_device *hid = hiddev->hid at the beginning of ioctl and then use it. This change checks hiddev->exist flag while holding the existancelock and uses hid_device only if it exists. Signed-off-by: Valentine Barshak Signed-off-by: Jiri Kosina --- Reading git-diff-tree failed