From: Dan Carpenter <dan.carpenter@oracle.com>
To: Zhang Rui <rui.zhang@intel.com>
Cc: Len Brown <lenb@kernel.org>,
linux-acpi@vger.kernel.org, Dmitry Torokhov <dtor@mail.ru>,
kernel-janitors@vger.kernel.org
Subject: [patch] ACPI video: use after input_unregister_device()
Date: Wed, 04 Apr 2012 11:19:16 +0000 [thread overview]
Message-ID: <20120404111916.GA23719@elgon.mountain> (raw)
We can't use "input" anymore after calling input_unregister_device().
The call to input_free_device() is a double free. The normal way to
deal with this is to make input_register_device() the last function
called in the function.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 9577b6f..51aba50a 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1687,10 +1687,6 @@ static int acpi_video_bus_add(struct acpi_device *device)
set_bit(KEY_BRIGHTNESS_ZERO, input->keybit);
set_bit(KEY_DISPLAY_OFF, input->keybit);
- error = input_register_device(input);
- if (error)
- goto err_stop_video;
-
printk(KERN_INFO PREFIX "%s [%s] (multi-head: %s rom: %s post: %s)\n",
ACPI_VIDEO_DEVICE_NAME, acpi_device_bid(device),
video->flags.multihead ? "yes" : "no",
@@ -1701,12 +1697,16 @@ static int acpi_video_bus_add(struct acpi_device *device)
video->pm_nb.priority = 0;
error = register_pm_notifier(&video->pm_nb);
if (error)
- goto err_unregister_input_dev;
+ goto err_stop_video;
+
+ error = input_register_device(input);
+ if (error)
+ goto err_unregister_pm_notifier;
return 0;
- err_unregister_input_dev:
- input_unregister_device(input);
+ err_unregister_pm_notifier:
+ unregister_pm_notifier(&video->pm_nb);
err_stop_video:
acpi_video_bus_stop_devices(video);
err_free_input_dev:
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Zhang Rui <rui.zhang@intel.com>
Cc: Len Brown <lenb@kernel.org>,
linux-acpi@vger.kernel.org, Dmitry Torokhov <dtor@mail.ru>,
kernel-janitors@vger.kernel.org
Subject: [patch] ACPI video: use after input_unregister_device()
Date: Wed, 4 Apr 2012 14:19:16 +0300 [thread overview]
Message-ID: <20120404111916.GA23719@elgon.mountain> (raw)
We can't use "input" anymore after calling input_unregister_device().
The call to input_free_device() is a double free. The normal way to
deal with this is to make input_register_device() the last function
called in the function.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 9577b6f..51aba50a 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1687,10 +1687,6 @@ static int acpi_video_bus_add(struct acpi_device *device)
set_bit(KEY_BRIGHTNESS_ZERO, input->keybit);
set_bit(KEY_DISPLAY_OFF, input->keybit);
- error = input_register_device(input);
- if (error)
- goto err_stop_video;
-
printk(KERN_INFO PREFIX "%s [%s] (multi-head: %s rom: %s post: %s)\n",
ACPI_VIDEO_DEVICE_NAME, acpi_device_bid(device),
video->flags.multihead ? "yes" : "no",
@@ -1701,12 +1697,16 @@ static int acpi_video_bus_add(struct acpi_device *device)
video->pm_nb.priority = 0;
error = register_pm_notifier(&video->pm_nb);
if (error)
- goto err_unregister_input_dev;
+ goto err_stop_video;
+
+ error = input_register_device(input);
+ if (error)
+ goto err_unregister_pm_notifier;
return 0;
- err_unregister_input_dev:
- input_unregister_device(input);
+ err_unregister_pm_notifier:
+ unregister_pm_notifier(&video->pm_nb);
err_stop_video:
acpi_video_bus_stop_devices(video);
err_free_input_dev:
next reply other threads:[~2012-04-04 11:19 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-04 11:19 Dan Carpenter [this message]
2012-04-04 11:19 ` [patch] ACPI video: use after input_unregister_device() Dan Carpenter
2012-04-04 16:19 ` Dmitry Torokhov
2012-04-04 16:19 ` Dmitry Torokhov
2012-06-01 17:42 ` Len Brown
2012-06-01 17:42 ` Len Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120404111916.GA23719@elgon.mountain \
--to=dan.carpenter@oracle.com \
--cc=dtor@mail.ru \
--cc=kernel-janitors@vger.kernel.org \
--cc=lenb@kernel.org \
--cc=linux-acpi@vger.kernel.org \
--cc=rui.zhang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.