[PATCH] HID: core: cleanup .claimed field on disconnect

[Benjamin Tissoires]

When a subdriver is rmmod-ed then re-insmod-ed, the hid device is not
destroyed as it is owned by the transport layer.
So when we re-probed the device, the hid device is assumed to be already
claimed, and can lead to page faults if hid-core tries to forward the
emitted data to the to-be-created claimed node.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@xxxxxxxxxx>
---

Hi Jiri,

[keeping the people involved in the logitech-hidpp driver in CC]

this one was particularly nasty. I had several page faults when just
rmmod && insmod the hid-logitech-hidpp driver. The page fault was occuring
in hidraw :/
I was not able to get a stacktrace which I could include here. The laptop was
completely unresponsive and I could take only a picture to debug it.

Cheers,
Benjamin

 drivers/hid/hid-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 1e2d512..bbb138d 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1656,6 +1656,7 @@ void hid_disconnect(struct hid_device *hdev)
 		hdev->hiddev_disconnect(hdev);
 	if (hdev->claimed & HID_CLAIMED_HIDRAW)
 		hidraw_disconnect(hdev);
+	hdev->claimed = 0;
 }
 EXPORT_SYMBOL_GPL(hid_disconnect);
 
-- 
2.1.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/