From cd7a9202a5a6e7712df2b80ed5ebd7b078130fc3 Mon Sep 17 00:00:00 2001 From: Kyle McMartin Date: Thu, 30 Mar 2006 11:47:32 -0500 Subject: [PATCH] [PARISC] Fix double free when removing HIL drivers On Thu, Mar 30, 2006 at 08:31:02AM -0500, Dmitry Torokhov wrote: > Don't do that, its double free. input_unregister_device() normally > causes release() to be called and free the device. input_free_device > is only to be called when input_register_device has not been called or > failed. > > Plus you might want to unregister device after closing serio port, > otherwise your interrupt routine might be referencing already freed > memory. Signed-off-by: Kyle McMartin --- drivers/input/keyboard/hil_kbd.c | 3 +-- drivers/input/keyboard/hilkbd.c | 1 - drivers/input/mouse/hil_ptr.c | 3 +-- 3 files changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c index 99f8c5b4cd50..63f387e4b783 100644 --- a/drivers/input/keyboard/hil_kbd.c +++ b/drivers/input/keyboard/hil_kbd.c @@ -240,9 +240,8 @@ static void hil_kbd_disconnect(struct serio *serio) return; } - input_unregister_device(kbd->dev); serio_close(serio); - input_free_device(kbd->dev); + input_unregister_device(kbd->dev); kfree(kbd); } diff --git a/drivers/input/keyboard/hilkbd.c b/drivers/input/keyboard/hilkbd.c index 452c5f3e6129..33edd030aa75 100644 --- a/drivers/input/keyboard/hilkbd.c +++ b/drivers/input/keyboard/hilkbd.c @@ -334,7 +334,6 @@ static void __exit hil_exit(void) input_unregister_device(hil_dev.dev); - input_free_device(hil_dev.dev); hil_dev.dev = NULL; #if defined(CONFIG_PARISC) diff --git a/drivers/input/mouse/hil_ptr.c b/drivers/input/mouse/hil_ptr.c index a648f9fe3d95..bfb564fd8fe2 100644 --- a/drivers/input/mouse/hil_ptr.c +++ b/drivers/input/mouse/hil_ptr.c @@ -233,9 +233,8 @@ static void hil_ptr_disconnect(struct serio *serio) return; } - input_unregister_device(ptr->dev); serio_close(serio); - input_free_device(ptr->dev); + input_unregister_device(ptr->dev); kfree(ptr); }