Input: make sure input interfaces pin parent input devices
Recent driver core change causes references to parent devices being
dropped early, at device_del() time, as opposed to when all children
are freed. This causes oops in evdev with grabbed devices. Take the
reference to the parent input device ourselves to ensure that it
stays around long enough.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 99562ce..b32984b 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -124,6 +124,7 @@
{
struct evdev *evdev = container_of(dev, struct evdev, dev);
+ input_put_device(evdev->handle.dev);
kfree(evdev);
}
@@ -853,9 +854,6 @@
evdev_hangup(evdev);
evdev_remove_chrdev(evdev);
- if (evdev->grab)
- evdev_ungrab(evdev, evdev->grab);
-
/* evdev is marked dead so no one else accesses evdev->open */
if (evdev->open) {
input_flush_device(handle, NULL);
@@ -896,7 +894,7 @@
evdev->exist = 1;
evdev->minor = minor;
- evdev->handle.dev = dev;
+ evdev->handle.dev = input_get_device(dev);
evdev->handle.name = evdev->name;
evdev->handle.handler = handler;
evdev->handle.private = evdev;
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 22b2789..65d7077 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -171,6 +171,7 @@
{
struct joydev *joydev = container_of(dev, struct joydev, dev);
+ input_put_device(joydev->handle.dev);
kfree(joydev);
}
@@ -750,7 +751,7 @@
joydev->minor = minor;
joydev->exist = 1;
- joydev->handle.dev = dev;
+ joydev->handle.dev = input_get_device(dev);
joydev->handle.name = joydev->name;
joydev->handle.handler = handler;
joydev->handle.private = joydev;
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index bbbe5e8..b989748 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -414,6 +414,7 @@
{
struct mousedev *mousedev = container_of(dev, struct mousedev, dev);
+ input_put_device(mousedev->handle.dev);
kfree(mousedev);
}
@@ -865,7 +866,7 @@
mousedev->minor = minor;
mousedev->exist = 1;
- mousedev->handle.dev = dev;
+ mousedev->handle.dev = input_get_device(dev);
mousedev->handle.name = mousedev->name;
mousedev->handle.handler = handler;
mousedev->handle.private = mousedev;
diff --git a/include/linux/input.h b/include/linux/input.h
index 1bdc39a..cae2c35 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -1227,12 +1227,13 @@
static inline struct input_dev *input_get_device(struct input_dev *dev)
{
- return to_input_dev(get_device(&dev->dev));
+ return dev ? to_input_dev(get_device(&dev->dev)) : NULL;
}
static inline void input_put_device(struct input_dev *dev)
{
- put_device(&dev->dev);
+ if (dev)
+ put_device(&dev->dev);
}
static inline void *input_get_drvdata(struct input_dev *dev)