del_timer() does not wait for a possible running callback to complete. So the call side might free request and the associated objects while on another cpu the timer handler runs.
Signed-off-by: Thomas Gleixner <t...@linutronix.de> Cc: Martin Schwidefsky <schwidef...@de.ibm.com> Cc: s390 <linux-s...@vger.kernel.org> --- drivers/s390/char/tape_std.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: tip/drivers/s390/char/tape_std.c =================================================================== --- tip.orig/drivers/s390/char/tape_std.c +++ tip/drivers/s390/char/tape_std.c @@ -78,7 +78,7 @@ tape_std_assign(struct tape_device *devi rc = tape_do_io_interruptible(device, request); - del_timer(&timeout); + del_timer_sync(&timeout); if (rc != 0) { DBF_EVENT(3, "%08x: assign failed - device might be busy\n", -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/