HID: hid-sjoy: race between init and usage

The driver uses an initial IO to set the device to a default
state. That initialization is currently being done after the device
node has been created. That means that the single buffer used
for output can be altered while IO is in progress.
Move the intialization before announcement to user space.

Fixes: fac733f029251 ("HID: force feedback support for SmartJoy PLUS PS2/USB adapter")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>

diff --git a/drivers/hid/hid-sjoy.c b/drivers/hid/hid-sjoy.c
index bab93d71b7608fbd43919980686b6ecb1d361589..963c451132045b25f73347e0357756515f84a89e 100644 (file)
--- a/drivers/hid/hid-sjoy.c
+++ b/drivers/hid/hid-sjoy.c
@@ -91,17 +91,17 @@ static int sjoyff_init(struct hid_device *hid)
 
                set_bit(FF_RUMBLE, dev->ffbit);
 
-               error = input_ff_create_memless(dev, sjoyff, hid_sjoyff_play);
-               if (error) {
-                       kfree(sjoyff);
-                       return error;
-               }
-
                sjoyff->report = report;
                sjoyff->report->field[0]->value[0] = 0x01;
                sjoyff->report->field[0]->value[1] = 0x00;
                sjoyff->report->field[0]->value[2] = 0x00;
                hid_hw_request(hid, sjoyff->report, HID_REQ_SET_REPORT);
+
+               error = input_ff_create_memless(dev, sjoyff, hid_sjoyff_play);
+               if (error) {
+                       kfree(sjoyff);
+                       return error;
+               }
        }
 
        hid_info(hid, "Force feedback for SmartJoy PLUS PS2/USB adapter\n");