Commit ab21b63e authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman

Revert "usbtmc: convert to devm_kzalloc"

This reverts commit e6c7efdc.

Turns out it was totally wrong.  The memory is supposed to be bound to
the kref, as the original code was doing correctly, not the
device/driver binding as the devm_kzalloc() would cause.

This fixes an oops when read would be called after the device was
unbound from the driver.
Reported-by: default avatarLadislav Michl <ladis@linux-mips.org>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable <stable@vger.kernel.org>  # 3.12+
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent decc5360
...@@ -141,6 +141,7 @@ static void usbtmc_delete(struct kref *kref) ...@@ -141,6 +141,7 @@ static void usbtmc_delete(struct kref *kref)
struct usbtmc_device_data *data = to_usbtmc_data(kref); struct usbtmc_device_data *data = to_usbtmc_data(kref);
usb_put_dev(data->usb_dev); usb_put_dev(data->usb_dev);
kfree(data);
} }
static int usbtmc_open(struct inode *inode, struct file *filp) static int usbtmc_open(struct inode *inode, struct file *filp)
...@@ -1379,7 +1380,7 @@ static int usbtmc_probe(struct usb_interface *intf, ...@@ -1379,7 +1380,7 @@ static int usbtmc_probe(struct usb_interface *intf,
dev_dbg(&intf->dev, "%s called\n", __func__); dev_dbg(&intf->dev, "%s called\n", __func__);
data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); data = kmalloc(sizeof(*data), GFP_KERNEL);
if (!data) if (!data)
return -ENOMEM; return -ENOMEM;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment