move device->release call in SoftU2FUserClient::start

we could have wound up calling device->release and/or device->detach after the device was already freed.
github · Jul 25, 2017 · 3d793fd · 3d793fd
1 parent d721f60
commit 3d793fd
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/SoftU2FDriver/SoftU2FUserClient.cpp b/SoftU2FDriver/SoftU2FUserClient.cpp
@@ -94,8 +94,6 @@ bool SoftU2FUserClient::start(IOService *provider) {
   if (!device->start(this))
     goto fail_device_start;
 
-  device->release();
-
   workLoop = getWorkLoop();
   if (!workLoop)
     goto fail_no_workloop;
@@ -107,6 +105,10 @@ bool SoftU2FUserClient::start(IOService *provider) {
   if (workLoop->addEventSource(_commandGate) != kIOReturnSuccess)
     goto fail_add_event_source;
 
+  // Our call to device->attach took a retain on the device when it was added to the registry.
+  // That will be released when the device is detached from the registry.
+  device->release();
+
   return true;
 
 fail_add_event_source: