This is an automatic generated email to let you know that the following patch were queued at the http://git.linuxtv.org/media_tree.git tree:
Subject: [media] s2255: Do not free fw_data until timer handler has actually stopped using it Author: Kirill Tkhai <[email protected]> Date: Thu Apr 17 17:47:04 2014 -0300 Function del_timer() does not guarantee that timer was really deleted. If the timer handler is beeing executed at the moment, the function does nothing. So, we have a race between del_timer() and kfree(), and it's possible to use already freed memory in the handler. Signed-off-by: Kirill Tkhai <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]> drivers/media/usb/s2255/s2255drv.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- http://git.linuxtv.org/media_tree.git?a=commitdiff;h=9f6be2bc403c0cea8d7b72cd5d42bd1a22b369ed diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c index e019dd6..185be72 100644 --- a/drivers/media/usb/s2255/s2255drv.c +++ b/drivers/media/usb/s2255/s2255drv.c @@ -1521,7 +1521,7 @@ static void s2255_destroy(struct s2255_dev *dev) /* board shutdown stops the read pipe if it is running */ s2255_board_shutdown(dev); /* make sure firmware still not trying to load */ - del_timer(&dev->timer); /* only started in .probe and .open */ + del_timer_sync(&dev->timer); /* only started in .probe and .open */ if (dev->fw_data->fw_urb) { usb_kill_urb(dev->fw_data->fw_urb); usb_free_urb(dev->fw_data->fw_urb); @@ -2351,7 +2351,7 @@ errorREQFW: errorFWDATA2: usb_free_urb(dev->fw_data->fw_urb); errorFWURB: - del_timer(&dev->timer); + del_timer_sync(&dev->timer); errorEP: usb_put_dev(dev->udev); errorUDEV: _______________________________________________ linuxtv-commits mailing list [email protected] http://www.linuxtv.org/cgi-bin/mailman/listinfo/linuxtv-commits
