瀏覽代碼

USB: fix autosuspend race in skeleton driver

as the skeleton driver was made ready for autosuspend a race condition
was introduced. The reference to get device must be gotten before the
autosuspend counter is upped, as this operation may sleep, dropping BKL.
Dropping BKL means that the pointer to the device may become invalid.
Here's the fix.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Oliver Neukum 19 年之前
父節點
當前提交
5b06470816
共有 1 個文件被更改,包括 6 次插入4 次删除
  1. 6 4
      drivers/usb/usb-skeleton.c

+ 6 - 4
drivers/usb/usb-skeleton.c

@@ -90,13 +90,15 @@ static int skel_open(struct inode *inode, struct file *file)
 		goto exit;
 	}
 
+	/* increment our usage count for the device */
+	kref_get(&dev->kref);
+
 	/* prevent the device from being autosuspended */
 	retval = usb_autopm_get_interface(interface);
-	if (retval)
+	if (retval) {
+		kref_put(&dev->kref, skel_delete);
 		goto exit;
-
-	/* increment our usage count for the device */
-	kref_get(&dev->kref);
+	}
 
 	/* save our object in the file's private structure */
 	file->private_data = dev;