`comedi_auto_config()` uses `dev->class_dev` for logging a kernel
message after releasing `dev->mutex`.  There is an unlikely possibility
that the Comedi device `dev` will have been removed by the
`COMEDI_DEVCONFIG` ioctl() command.  Keep hold of the mutex until the
kernel message has been sent to prevent that.  The function can call
`comedi_release_hardware_device()` on error.  In that case, the mutex
must be unlocked before that.

Signed-off-by: Ian Abbott <abbo...@mev.co.uk>
---
 drivers/staging/comedi/drivers.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c
index 5a32b8fc000e..b7b9e48d4303 100644
--- a/drivers/staging/comedi/drivers.c
+++ b/drivers/staging/comedi/drivers.c
@@ -1059,12 +1059,12 @@ int comedi_auto_config(struct device *hardware_device,
        ret = driver->auto_attach(dev, context);
        if (ret >= 0)
                ret = comedi_device_postconfig(dev);
-       mutex_unlock(&dev->mutex);
 
        if (ret < 0) {
                dev_warn(hardware_device,
                         "driver '%s' failed to auto-configure device.\n",
                         driver->driver_name);
+               mutex_unlock(&dev->mutex);
                comedi_release_hardware_device(hardware_device);
        } else {
                /*
@@ -1074,6 +1074,7 @@ int comedi_auto_config(struct device *hardware_device,
                dev_info(dev->class_dev,
                         "driver '%s' has successfully auto-configured '%s'.\n",
                         driver->driver_name, dev->board_name);
+               mutex_unlock(&dev->mutex);
        }
        return ret;
 }
-- 
2.20.1

_______________________________________________
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Reply via email to