[media] ir: avoid race conditions at device disconnect

It is possible that, while ir_unregister_class() is handling, some
application could try to access the sysfs nodes, causing an OOPS.

Reviewed-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/IR/ir-sysfs.c b/drivers/media/IR/ir-sysfs.c
index be09d1995b419b97786b1bf442dc8fcc1a7d645e..186807aa226d0dc1676b3ff5a7b071f26c9bf516 100644 (file)
--- a/drivers/media/IR/ir-sysfs.c
+++ b/drivers/media/IR/ir-sysfs.c
@@ -68,6 +68,10 @@ static ssize_t show_protocols(struct device *d,
        char *tmp = buf;
        int i;
 
+       /* Device is being removed */
+       if (!ir_dev)
+               return -EINVAL;
+
        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                enabled = ir_dev->rc_tab.ir_type;
                allowed = ir_dev->props->allowed_protos;
@@ -123,6 +127,10 @@ static ssize_t store_protocols(struct device *d,
        int rc, i, count = 0;
        unsigned long flags;
 
+       /* Device is being removed */
+       if (!ir_dev)
+               return -EINVAL;
+
        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
                type = ir_dev->rc_tab.ir_type;
        else if (ir_dev->raw)
@@ -310,6 +318,7 @@ void ir_unregister_class(struct input_dev *input_dev)
 {
        struct ir_input_dev *ir_dev = input_get_drvdata(input_dev);
 
+       input_set_drvdata(input_dev, NULL);
        clear_bit(ir_dev->devno, &ir_core_dev_number);
        input_unregister_device(input_dev);
        device_del(&ir_dev->dev);