Input: make sure input interfaces pin parent input devices

Recent driver core change causes references to parent devices being
dropped early, at device_del() time, as opposed to when all children
are freed. This causes oops in evdev with grabbed devices. Take the
reference to the parent input device ourselves to ensure that it
stays around long enough.

Signed-off-by: Dmitry Torokhov <[email protected]>

diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 99562cee827e7c6af548ec2f889b3fc769dd9213..b32984bc516ff271cacbe72b56a60350bef63868 100644 (file)
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -124,6 +124,7 @@ static void evdev_free(struct device *dev)
 {
        struct evdev *evdev = container_of(dev, struct evdev, dev);
 
+       input_put_device(evdev->handle.dev);
        kfree(evdev);
 }
 
@@ -853,9 +854,6 @@ static void evdev_cleanup(struct evdev *evdev)
        evdev_hangup(evdev);
        evdev_remove_chrdev(evdev);
 
-       if (evdev->grab)
-               evdev_ungrab(evdev, evdev->grab);
-
        /* evdev is marked dead so no one else accesses evdev->open */
        if (evdev->open) {
                input_flush_device(handle, NULL);
@@ -896,7 +894,7 @@ static int evdev_connect(struct input_handler *handler, struct input_dev *dev,
        evdev->exist = 1;
        evdev->minor = minor;
 
-       evdev->handle.dev = dev;
+       evdev->handle.dev = input_get_device(dev);
        evdev->handle.name = evdev->name;
        evdev->handle.handler = handler;
        evdev->handle.private = evdev;

diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 22b2789ef58ad17e30299f5fcbc7f5587d11dba9..65d7077a75a19202288d4bc4484c19ca9b93c5c2 100644 (file)
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -171,6 +171,7 @@ static void joydev_free(struct device *dev)
 {
        struct joydev *joydev = container_of(dev, struct joydev, dev);
 
+       input_put_device(joydev->handle.dev);
        kfree(joydev);
 }
 
@@ -750,7 +751,7 @@ static int joydev_connect(struct input_handler *handler, struct input_dev *dev,
        joydev->minor = minor;
 
        joydev->exist = 1;
-       joydev->handle.dev = dev;
+       joydev->handle.dev = input_get_device(dev);
        joydev->handle.name = joydev->name;
        joydev->handle.handler = handler;
        joydev->handle.private = joydev;

diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index bbbe5e81adc1036d224925e4809ba05bd0fc22a5..b989748598ae2191cc58f806eb11a19290b847fe 100644 (file)
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -414,6 +414,7 @@ static void mousedev_free(struct device *dev)
 {
        struct mousedev *mousedev = container_of(dev, struct mousedev, dev);
 
+       input_put_device(mousedev->handle.dev);
        kfree(mousedev);
 }
 
@@ -865,7 +866,7 @@ static struct mousedev *mousedev_create(struct input_dev *dev,
 
        mousedev->minor = minor;
        mousedev->exist = 1;
-       mousedev->handle.dev = dev;
+       mousedev->handle.dev = input_get_device(dev);
        mousedev->handle.name = mousedev->name;
        mousedev->handle.handler = handler;
        mousedev->handle.private = mousedev;

diff --git a/include/linux/input.h b/include/linux/input.h
index 1bdc39a8c76c6a0916af7b6698fdcd219a26c1fb..cae2c35d1206593bc6a3154e44ae47ef1db6fb75 100644 (file)
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -1227,12 +1227,13 @@ void input_free_device(struct input_dev *dev);
 
 static inline struct input_dev *input_get_device(struct input_dev *dev)
 {
-       return to_input_dev(get_device(&dev->dev));
+       return dev ? to_input_dev(get_device(&dev->dev)) : NULL;
 }
 
 static inline void input_put_device(struct input_dev *dev)
 {
-       put_device(&dev->dev);
+       if (dev)
+               put_device(&dev->dev);
 }
 
 static inline void *input_get_drvdata(struct input_dev *dev)