From: Oliver Neukum <oliver@neukum.name>
Date: Fri, 24 Nov 2006 11:55:59 +0000 (+0100)
Subject: USB: fix transvibrator disconnect race
X-Git-Tag: v2.6.20-rc2~83^2~32
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=96ca014d53d2c2f9d3b32fe6f2f003e660c3bc63;p=linux-2.6

USB: fix transvibrator disconnect race

in disconnect you set the interface's private data to NULL. In your IO
methods you unconditionally follow the pointer into never never land.

Signed-off-by: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/usb/misc/trancevibrator.c b/drivers/usb/misc/trancevibrator.c
index 33cd91d11e..67e2fc20ee 100644
--- a/drivers/usb/misc/trancevibrator.c
+++ b/drivers/usb/misc/trancevibrator.c
@@ -120,8 +120,8 @@ static void tv_disconnect(struct usb_interface *interface)
 	struct trancevibrator *dev;
 
 	dev = usb_get_intfdata (interface);
-	usb_set_intfdata(interface, NULL);
 	device_remove_file(&interface->dev, &dev_attr_speed);
+	usb_set_intfdata(interface, NULL);
 	usb_put_dev(dev->udev);
 	kfree(dev);
 }