Am Sonntag, 11. Juli 2010, 15:34:05 schrieb Arnd Bergmann:
> --- a/drivers/hid/usbhid/hiddev.c
> +++ b/drivers/hid/usbhid/hiddev.c
> @@ -67,7 +67,7 @@ struct hiddev_list {
> struct mutex thread_lock;
> };
>
> -static struct hiddev *hiddev_table[HIDDEV_MINORS];
> +static struct usb_driver hiddev_driver;
>
> /*
> * Find a report, given the report's type and ID. The ID can be specified
> @@ -265,22 +265,19 @@ static int hiddev_release(struct inode * inode, struct file * file)
> static int hiddev_open(struct inode *inode, struct file *file)
> {
> struct hiddev_list *list;
> - int res, i;
> -
> - /* See comment in hiddev_connect() for BKL explanation */
> - lock_kernel();
> - i = iminor(inode) - HIDDEV_MINOR_BASE;
> + struct usb_interface *intf;
> + struct hiddev *hiddev;
> + int res;
>
> - if (i >= HIDDEV_MINORS || i < 0 || !hiddev_table[i])
> + intf = usb_find_interface(&hiddev_driver, iminor(inode));
What keeps the intf pointer valid after usb_find_interface() returns?
This seems racy.
> + if (!intf)
> return -ENODEV;
> + hiddev = usb_get_intfdata(intf);
Regards
Oliver
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
