summaryrefslogtreecommitdiff
path: root/drivers/media/usb/s2255
diff options
context:
space:
mode:
authorKirill Tkhai <tkhai@yandex.ru>2014-04-18 00:47:04 +0400
committerMauro Carvalho Chehab <m.chehab@samsung.com>2014-05-23 19:16:39 +0400
commit9f6be2bc403c0cea8d7b72cd5d42bd1a22b369ed (patch)
tree8174f22b98e60fb5d0de5a2c4b1b623902e18f77 /drivers/media/usb/s2255
parentcd6ff5c2dfb3f17e3b900738533a7f82a2030746 (diff)
downloadlinux-9f6be2bc403c0cea8d7b72cd5d42bd1a22b369ed.tar.xz
[media] s2255: Do not free fw_data until timer handler has actually stopped using it
Function del_timer() does not guarantee that timer was really deleted. If the timer handler is beeing executed at the moment, the function does nothing. So, we have a race between del_timer() and kfree(), and it's possible to use already freed memory in the handler. Signed-off-by: Kirill Tkhai <tkhai@yandex.ru> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Diffstat (limited to 'drivers/media/usb/s2255')
-rw-r--r--drivers/media/usb/s2255/s2255drv.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
index e019dd63ed42..185be72cab14 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -1521,7 +1521,7 @@ static void s2255_destroy(struct s2255_dev *dev)
/* board shutdown stops the read pipe if it is running */
s2255_board_shutdown(dev);
/* make sure firmware still not trying to load */
- del_timer(&dev->timer); /* only started in .probe and .open */
+ del_timer_sync(&dev->timer); /* only started in .probe and .open */
if (dev->fw_data->fw_urb) {
usb_kill_urb(dev->fw_data->fw_urb);
usb_free_urb(dev->fw_data->fw_urb);
@@ -2351,7 +2351,7 @@ errorREQFW:
errorFWDATA2:
usb_free_urb(dev->fw_data->fw_urb);
errorFWURB:
- del_timer(&dev->timer);
+ del_timer_sync(&dev->timer);
errorEP:
usb_put_dev(dev->udev);
errorUDEV: