From oneukum@suse.de Fri Mar 30 01:52:17 2007 From: Oliver Neukum Date: Fri, 30 Mar 2007 10:52:16 +0200 Subject: USB: cypress_cy7c63: race disconnect/sysfs read-write leading to following NULL pointer To: Greg KH , linux-usb-devel@lists.sourceforge.net Message-ID: <200703301052.16797.oneukum@suse.de> Content-Disposition: inline this driver sets intfdata to NULL while it still can be read and happily followed. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman --- drivers/usb/misc/cypress_cy7c63.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/usb/misc/cypress_cy7c63.c +++ b/drivers/usb/misc/cypress_cy7c63.c @@ -246,11 +246,13 @@ static void cypress_disconnect(struct us struct cypress *dev; dev = usb_get_intfdata(interface); - usb_set_intfdata(interface, NULL); /* remove device attribute files */ device_remove_file(&interface->dev, &dev_attr_port0); device_remove_file(&interface->dev, &dev_attr_port1); + /* the intfdata can be set to NULL only after the + * device files have been removed */ + usb_set_intfdata(interface, NULL); usb_put_dev(dev->udev);