From cb09d912e29605bc5a7bc6a204dda8c8f01cf10d Mon Sep 17 00:00:00 2001
From: H Hartley Sweeten <hsweeten@visionengravers.com>
Date: Mon, 29 Jul 2013 14:07:10 -0700
Subject: staging: comedi: das16: fix das16_detach()

The function das16_reset() needs a valid dev->iobase. Since the iobase
is requested after the devpriv has been allocated in the attach, move
the das16_reset() call into the if (devpriv) and add a if (dev->iobase).

Also, move the release of the extra iobase into the if (devpriv) to
prevent an invalid memory access.

Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/comedi/drivers/das16.c b/drivers/staging/comedi/drivers/das16.c
index 60895e6..9944f71 100644
--- a/drivers/staging/comedi/drivers/das16.c
+++ b/drivers/staging/comedi/drivers/das16.c
@@ -1206,10 +1206,12 @@ static void das16_detach(struct comedi_device *dev)
 {
 	const struct das16_board *board = comedi_board(dev);
 	struct das16_private_struct *devpriv = dev->private;
+	int i;
 
-	das16_reset(dev);
 	if (devpriv) {
-		int i;
+		if (dev->iobase)
+			das16_reset(dev);
+
 		for (i = 0; i < 2; i++) {
 			if (devpriv->dma_buffer[i])
 				pci_free_consistent(NULL, DAS16_DMA_SIZE,
@@ -1221,9 +1223,12 @@ static void das16_detach(struct comedi_device *dev)
 			free_dma(devpriv->dma_chan);
 		kfree(devpriv->user_ai_range_table);
 		kfree(devpriv->user_ao_range_table);
+
+		if (devpriv->extra_iobase)
+			release_region(devpriv->extra_iobase,
+				       board->size & 0x3ff);
 	}
-	if (devpriv->extra_iobase)
-		release_region(devpriv->extra_iobase, board->size & 0x3ff);
+
 	comedi_legacy_detach(dev);
 }
 
-- 
cgit v0.10.2