Calls to `comedi_auto_unconfig()` from low-level comedi drivers result in the `struct comedi_device` being freed along with any comedi data buffers. That's bad news for the 'read' and 'write' file operations that currently have no protection from this (they don't use the main mutex in the `struct comedi_device` for performance reasons). It's also bad news if the comedi data buffers have been mmapped. The functions in the "kcomedilib" module also need some protection. 01) staging: comedi: remove unused command callback support 02) staging: comedi: add a couple of #includes to comedidev.h 03) staging: comedi: add rw_semaphore to protect against device detachment 04) staging: comedi: use attach_lock semaphore during attach and detach 05) staging: comedi: cleanup_device() -> comedi_device_detach_cleanup() 06) staging: comedi: wake up async waiters when become non-busy 07) staging: comedi: cancel commands before detaching device 08) staging: comedi: add detachment counter for validity checks 09) staging: comedi: protect against detach during write operation 10) staging: comedi: protect against detach during read operation 11) staging: comedi: add a kref to comedi device 12) staging: comedi: add comedi_dev_get_from_minor() 13) staging: comedi: increment reference while file open 14) staging: comedi: use refcount in comedi_driver_unregister() 15) staging: comedi: use refcount while reading /proc/comedi 16) staging: comedi: use refcount in sysfs attribute handlers 17) staging: comedi: kcomedilib: increment reference while device in use 18) staging: comedi: kcomedilib: protect against device detachment 19) staging: comedi: use file->private_data in file operations 20) staging: comedi: remove comedi_dev_from_minor() 21) staging: comedi: make determination of read or write subdevice safer 22) staging: comedi: protect buffer from being freed while mmapped drivers/staging/comedi/comedi_buf.c | 99 ++++-- drivers/staging/comedi/comedi_fops.c | 358 +++++++++++++-------- drivers/staging/comedi/comedi_internal.h | 4 + drivers/staging/comedi/comedidev.h | 28 +- drivers/staging/comedi/drivers.c | 14 +- drivers/staging/comedi/drivers/mite.c | 2 +- .../staging/comedi/kcomedilib/kcomedilib_main.c | 74 +++-- drivers/staging/comedi/proc.c | 6 +- 8 files changed, 382 insertions(+), 203 deletions(-) _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel