USB: Phidget: fix race in device_create

There is a race from when a device is created with device_create() and
then the drvdata is set with a call to dev_set_drvdata() in which a
sysfs file could be open, yet the drvdata will be NULL, causing all
sorts of bad things to happen.

This patch fixes the problem by using the new function,
device_create_drvdata().  It fixes all 3 phidget drivers, which all have
the same problem.

Cc: Kay Sievers <kay.sievers@vrfy.org>
Cc: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/misc/phidgetkit.c b/drivers/usb/misc/phidgetkit.c
index 24230c638b8e639b0c6ccef2d2bb3264a2f50116..4cfa25b0f44e5620bc45b4447eee62737bf523f2 100644 (file)
--- a/drivers/usb/misc/phidgetkit.c
+++ b/drivers/usb/misc/phidgetkit.c
@@ -595,14 +595,14 @@ static int interfacekit_probe(struct usb_interface *intf, const struct usb_devic
         } while(value);
         kit->dev_no = bit;
 
-        kit->dev = device_create(phidget_class, &kit->udev->dev, 0,
-                               "interfacekit%d", kit->dev_no);
+       kit->dev = device_create_drvdata(phidget_class, &kit->udev->dev,
+                                       MKDEV(0, 0), kit,
+                                       "interfacekit%d", kit->dev_no);
         if (IS_ERR(kit->dev)) {
                 rc = PTR_ERR(kit->dev);
                 kit->dev = NULL;
                 goto out;
         }
-       dev_set_drvdata(kit->dev, kit);
 
        if (usb_submit_urb(kit->irq, GFP_KERNEL)) {
                rc = -EIO;

diff --git a/drivers/usb/misc/phidgetmotorcontrol.c b/drivers/usb/misc/phidgetmotorcontrol.c
index f0113c17cc5afd1d0c6b01173161f57fabc5ea30..9b4696f21b22849079b062336b7ef93aa1ed757e 100644 (file)
--- a/drivers/usb/misc/phidgetmotorcontrol.c
+++ b/drivers/usb/misc/phidgetmotorcontrol.c
@@ -365,16 +365,15 @@ static int motorcontrol_probe(struct usb_interface *intf, const struct usb_devic
        } while(value);
        mc->dev_no = bit;
 
-       mc->dev = device_create(phidget_class, &mc->udev->dev, 0,
-                               "motorcontrol%d", mc->dev_no);
+       mc->dev = device_create_drvdata(phidget_class, &mc->udev->dev,
+                                       MKDEV(0, 0), mc,
+                                       "motorcontrol%d", mc->dev_no);
        if (IS_ERR(mc->dev)) {
                rc = PTR_ERR(mc->dev);
                mc->dev = NULL;
                goto out;
        }
 
-       dev_set_drvdata(mc->dev, mc);
-
        if (usb_submit_urb(mc->irq, GFP_KERNEL)) {
                rc = -EIO;
                goto out;

diff --git a/drivers/usb/misc/phidgetservo.c b/drivers/usb/misc/phidgetservo.c
index 7d590c09434ad6e009e4a1cb4e4a1627ed97f914..1ca7ddb41d4dfe0014381391766bf8898947aa69 100644 (file)
--- a/drivers/usb/misc/phidgetservo.c
+++ b/drivers/usb/misc/phidgetservo.c
@@ -275,14 +275,14 @@ servo_probe(struct usb_interface *interface, const struct usb_device_id *id)
         } while (value);
        dev->dev_no = bit;
 
-       dev->dev = device_create(phidget_class, &dev->udev->dev, 0,
-                                "servo%d", dev->dev_no);
+       dev->dev = device_create_drvdata(phidget_class, &dev->udev->dev,
+                                        MKDEV(0, 0), dev,
+                                        "servo%d", dev->dev_no);
        if (IS_ERR(dev->dev)) {
                rc = PTR_ERR(dev->dev);
                dev->dev = NULL;
                goto out;
        }
-       dev_set_drvdata(dev->dev, dev);
 
        servo_count = dev->type & SERVO_COUNT_QUAD ? 4 : 1;