Commit 8f59100a authored by Mike Isely's avatar Mike Isely Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (7320): pvrusb2: Eliminate timer race during tear-down 



The pvrusb2 tear-down logic was clearing two timers before stopping
its internal work queue.  That left a tiny window open where the work
queue might run after the timers are stopped, possibly starting them
again.  This could lead to dangling pointers and an oops.  Solution:
Kill the work queue first, then delete the timers.

Signed-off-by: default avatarMike Isely <isely@pobox.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
parent c4a8828d

drivers/media/video/pvrusb2/pvrusb2-hdw.c

+2 −2
Original line number Diff line number Diff line
@@ -2114,13 +2114,13 @@ void pvr2_hdw_destroy(struct pvr2_hdw *hdw) 
{

	if (!hdw) return;

	pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_destroy: hdw=%p",hdw);

	del_timer_sync(&hdw->quiescent_timer);

	del_timer_sync(&hdw->encoder_wait_timer);

	if (hdw->workqueue) {

		flush_workqueue(hdw->workqueue);

		destroy_workqueue(hdw->workqueue);

		hdw->workqueue = NULL;

	}

	del_timer_sync(&hdw->quiescent_timer);

	del_timer_sync(&hdw->encoder_wait_timer);

	if (hdw->fw_buffer) {

		kfree(hdw->fw_buffer);

		hdw->fw_buffer = NULL;