diff options
author | Kyle McMartin <kyle@parisc-linux.org> | 2006-03-30 11:47:32 -0500 |
---|---|---|
committer | Kyle McMartin <kyle@hera.kernel.org> | 2006-03-30 12:48:59 -0500 |
commit | cd7a9202a5a6e7712df2b80ed5ebd7b078130fc3 (patch) | |
tree | c7e2504dd6de0d2412815dce658468f7add77173 /drivers/input/keyboard | |
parent | 4da9f131a74d12de56c44da6d522a9116da06805 (diff) |
[PARISC] Fix double free when removing HIL drivers
On Thu, Mar 30, 2006 at 08:31:02AM -0500, Dmitry Torokhov wrote:
> Don't do that, its double free. input_unregister_device() normally
> causes release() to be called and free the device. input_free_device
> is only to be called when input_register_device has not been called or
> failed.
>
> Plus you might want to unregister device after closing serio port,
> otherwise your interrupt routine might be referencing already freed
> memory.
Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
Diffstat (limited to 'drivers/input/keyboard')
-rw-r--r-- | drivers/input/keyboard/hil_kbd.c | 3 | ||||
-rw-r--r-- | drivers/input/keyboard/hilkbd.c | 1 |
2 files changed, 1 insertions, 3 deletions
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c index 99f8c5b4cd50..63f387e4b783 100644 --- a/drivers/input/keyboard/hil_kbd.c +++ b/drivers/input/keyboard/hil_kbd.c | |||
@@ -240,9 +240,8 @@ static void hil_kbd_disconnect(struct serio *serio) | |||
240 | return; | 240 | return; |
241 | } | 241 | } |
242 | 242 | ||
243 | input_unregister_device(kbd->dev); | ||
244 | serio_close(serio); | 243 | serio_close(serio); |
245 | input_free_device(kbd->dev); | 244 | input_unregister_device(kbd->dev); |
246 | kfree(kbd); | 245 | kfree(kbd); |
247 | } | 246 | } |
248 | 247 | ||
diff --git a/drivers/input/keyboard/hilkbd.c b/drivers/input/keyboard/hilkbd.c index 452c5f3e6129..33edd030aa75 100644 --- a/drivers/input/keyboard/hilkbd.c +++ b/drivers/input/keyboard/hilkbd.c | |||
@@ -334,7 +334,6 @@ static void __exit hil_exit(void) | |||
334 | 334 | ||
335 | input_unregister_device(hil_dev.dev); | 335 | input_unregister_device(hil_dev.dev); |
336 | 336 | ||
337 | input_free_device(hil_dev.dev); | ||
338 | hil_dev.dev = NULL; | 337 | hil_dev.dev = NULL; |
339 | 338 | ||
340 | #if defined(CONFIG_PARISC) | 339 | #if defined(CONFIG_PARISC) |