USB: fix read vs. disconnect race in cytherm driver

the disconnect method of this driver set intfdata to NULL before
removing attribute files. The attributes' read methods will happily
follow the NULL pointer. Here's the correct ordering.

Signed-off-by : Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/misc/cytherm.c b/drivers/usb/misc/cytherm.c
index 2677fea147d9ef163053c8a2b458edf170515aec..1cd9e7eba93bd43fc1ef1f74b6fb06187a14bc32 100644 (file)
--- a/drivers/usb/misc/cytherm.c
+++ b/drivers/usb/misc/cytherm.c
@@ -399,7 +399,6 @@ static void cytherm_disconnect(struct usb_interface *interface)
        struct usb_cytherm *dev;
 
        dev = usb_get_intfdata (interface);
-       usb_set_intfdata (interface, NULL);
 
        device_remove_file(&interface->dev, &dev_attr_brightness);
        device_remove_file(&interface->dev, &dev_attr_temp);
@@ -407,6 +406,9 @@ static void cytherm_disconnect(struct usb_interface *interface)
        device_remove_file(&interface->dev, &dev_attr_port0);
        device_remove_file(&interface->dev, &dev_attr_port1);
 
+       /* first remove the files, then NULL the pointer */
+       usb_set_intfdata (interface, NULL);
+
        usb_put_dev(dev->udev);
 
        kfree(dev);