Input: psmouse - fix cleaning up SMBus companions

When trying to destroy platform data after destruction of SMbus companion,
we need to make sure that we are actually dealing with an SMB companion
device, and not some random I2C client device.

Fixes: 8eb92e5c9133 ("Input: psmouse - add support for SMBus companions")
Reported-by: Benjamin Tissoires <[e-mail]>
Tested-by: Benjamin Tissoires <[e-mail]>
Signed-off-by: Dmitry Torokhov <[e-mail]>

drivers/input/mouse/psmouse-smbus.c

···
 
 static void psmouse_smbus_detach_i2c_client(struct i2c_client *client)
 {
-	struct psmouse_smbus_dev *smbdev;
+	struct psmouse_smbus_dev *smbdev, *tmp;
 
 	mutex_lock(&psmouse_smbus_mutex);
 
-	list_for_each_entry(smbdev, &psmouse_smbus_list, node) {
-		if (smbdev->client == client) {
+	list_for_each_entry_safe(smbdev, tmp, &psmouse_smbus_list, node) {
+		if (smbdev->client != client)
+			continue;
+
+		kfree(client->dev.platform_data);
+		client->dev.platform_data = NULL;
+
+		if (!smbdev->dead) {
 			psmouse_dbg(smbdev->psmouse,
 				    "Marking SMBus companion %s as gone\n",
 				    dev_name(&smbdev->client->dev));
-			smbdev->client = NULL;
 			smbdev->dead = true;
 			serio_rescan(smbdev->psmouse->ps2dev.serio);
+		} else {
+			list_del(&smbdev->node);
+			kfree(smbdev);
 		}
 	}
-
-	kfree(client->dev.platform_data);
-	client->dev.platform_data = NULL;
 
 	mutex_unlock(&psmouse_smbus_mutex);
 }
···
 	struct psmouse_smbus_dev *smbdev = psmouse->private;
 
 	mutex_lock(&psmouse_smbus_mutex);
-	list_del(&smbdev->node);
-	mutex_unlock(&psmouse_smbus_mutex);
 
-	if (smbdev->client) {
+	if (smbdev->dead) {
+		list_del(&smbdev->node);
+		kfree(smbdev);
+	} else {
+		smbdev->dead = true;
 		psmouse_dbg(smbdev->psmouse,
 			    "posting removal request for SMBus companion %s\n",
 			    dev_name(&smbdev->client->dev));
 		psmouse_smbus_schedule_remove(smbdev->client);
 	}
 
-	kfree(smbdev);
+	mutex_unlock(&psmouse_smbus_mutex);
+
 	psmouse->private = NULL;
 }