[PATCH v2 0/2] media: rc: ati_remote: fix NULL input device handling

[YuanZhe Liu]

This series fixes two ways ati_remote can pass a NULL input device to
input_event():

  1. ati_remote_probe() registers the rc device before it sets up the
     mouse input device.  The rc device can be opened as soon as it is
     registered, which submits the interrupt URB, and a report arriving
     before ati_remote->idev is assigned dereferences the NULL pointer.
     Move the input device setup before rc_register_device(), and free
     the input device only after the rc device has been unregistered and
     the URBs have been killed.

  2. With the "mouse" module parameter disabled, the mouse input device
     is never allocated, but the rc device still accepts mouse scancodes
     and reports them through ati_remote->idev.  Restore the check that
     drops mouse events when there is no mouse device.

The two issues have different root causes and are fixed in separate
patches.

The series applies to v7.3-rc7 and was validated with checkpatch, by
replaying it on a clean tree, and by building drivers/media/rc/ with
W=1 for x86_64.

Changes in v2:
  - Do not call rc_unregister_device() when rc_register_device() fails.
  - On input_register_device() failure, unregister the rc device and
    kill the URBs before freeing the input device.
  - Add a second patch for the mouse=0 case.

YuanZhe Liu (2):
  media: rc: ati_remote: fix NULL input_dev on rc device open
  media: rc: ati_remote: fix NULL input_dev when mouse=0

 drivers/media/rc/ati_remote.c | 37 +++++++++++++++++++++++------------
 1 file changed, 25 insertions(+), 12 deletions(-)

-- 
2.34.1