[PARISC] Fix double free when removing HIL drivers

On Thu, Mar 30, 2006 at 08:31:02AM -0500, Dmitry Torokhov wrote:
> Don't do that, its double free. input_unregister_device() normally
> causes release() to be called and free the device. input_free_device
> is only to be called when input_register_device has not been called or
> failed.
>
> Plus you might want to unregister device after closing serio port,
> otherwise your interrupt routine might be referencing already freed
> memory.

Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>

diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 99f8c5b4cd505830aabad53db9764f0d52c2584c..63f387e4b783d4d23d85b76554552b33975c8920 100644 (file)
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -240,9 +240,8 @@ static void hil_kbd_disconnect(struct serio *serio)
                return;
        }
 
-       input_unregister_device(kbd->dev);
        serio_close(serio);
-       input_free_device(kbd->dev);
+       input_unregister_device(kbd->dev);
        kfree(kbd);
 }
 

diff --git a/drivers/input/keyboard/hilkbd.c b/drivers/input/keyboard/hilkbd.c
index 452c5f3e612937c61050fa7765fee5bcb8b55341..33edd030aa758048f6b9ab11bd0463609da4c6ab 100644 (file)
--- a/drivers/input/keyboard/hilkbd.c
+++ b/drivers/input/keyboard/hilkbd.c
@@ -334,7 +334,6 @@ static void __exit hil_exit(void)
 
        input_unregister_device(hil_dev.dev);
 
-       input_free_device(hil_dev.dev);
        hil_dev.dev = NULL;
 
 #if defined(CONFIG_PARISC)

diff --git a/drivers/input/mouse/hil_ptr.c b/drivers/input/mouse/hil_ptr.c
index a648f9fe3d95d6e3edb82f8658aafe03504784a0..bfb564fd8fe2ed0a4db4d42c60b57ccd21c68705 100644 (file)
--- a/drivers/input/mouse/hil_ptr.c
+++ b/drivers/input/mouse/hil_ptr.c
@@ -233,9 +233,8 @@ static void hil_ptr_disconnect(struct serio *serio)
                return;
        }
 
-       input_unregister_device(ptr->dev);
        serio_close(serio);
-       input_free_device(ptr->dev);
+       input_unregister_device(ptr->dev);
        kfree(ptr);
 }