media: pulse8-cec: close serio in disconnect, not adap_free

The serio_close() call was moved to pulse8_cec_adap_free(),
but that can be too late if that is called after the serio
core pulled down the serio already, in which case you get
a kernel oops.

Keep it in the disconnect().

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Fixes: 601282d65b96 ("media: pulse8-cec: use adap_free callback")
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c
index 8d61bcec14bb896824026df97ddf23975d2cb813..0655aa9ecf283a6a73231d12413300a4f7a4c3fa 100644 (file)
--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c
+++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c
@@ -635,8 +635,6 @@ static void pulse8_cec_adap_free(struct cec_adapter *adap)
        cancel_delayed_work_sync(&pulse8->ping_eeprom_work);
        cancel_work_sync(&pulse8->irq_work);
        cancel_work_sync(&pulse8->tx_work);
-       serio_close(pulse8->serio);
-       serio_set_drvdata(pulse8->serio, NULL);
        kfree(pulse8);
 }
 
@@ -652,6 +650,9 @@ static void pulse8_disconnect(struct serio *serio)
        struct pulse8 *pulse8 = serio_get_drvdata(serio);
 
        cec_unregister_adapter(pulse8->adap);
+       pulse8->serio = NULL;
+       serio_set_drvdata(serio, NULL);
+       serio_close(serio);
 }
 
 static int pulse8_setup(struct pulse8 *pulse8, struct serio *serio,
@@ -872,10 +873,11 @@ static int pulse8_connect(struct serio *serio, struct serio_driver *drv)
        return 0;
 
 close_serio:
+       pulse8->serio = NULL;
+       serio_set_drvdata(serio, NULL);
        serio_close(serio);
 delete_adap:
        cec_delete_adapter(pulse8->adap);
-       serio_set_drvdata(serio, NULL);
 free_device:
        kfree(pulse8);
        return err;