1 From 8d4068810d9926250dd2435719a080b889eb44c3 Mon Sep 17 00:00:00 2001
2 From: Sean Young <sean@mess.org>
3 Date: Tue, 6 Mar 2018 08:57:57 -0500
4 Subject: media: rc: oops in ir_timer_keyup after device unplug
6 From: Sean Young <sean@mess.org>
8 commit 8d4068810d9926250dd2435719a080b889eb44c3 upstream.
10 If there is IR in the raw kfifo when ir_raw_event_unregister() is called,
11 then kthread_stop() causes ir_raw_event_thread to be scheduled, decode
12 some scancodes and re-arm timer_keyup. The timer_keyup then fires when
13 the rc device is long gone.
15 Cc: stable@vger.kernel.org
16 Signed-off-by: Sean Young <sean@mess.org>
17 Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
21 drivers/media/rc/rc-main.c | 6 +++---
22 1 file changed, 3 insertions(+), 3 deletions(-)
24 --- a/drivers/media/rc/rc-main.c
25 +++ b/drivers/media/rc/rc-main.c
26 @@ -1929,12 +1929,12 @@ void rc_unregister_device(struct rc_dev
30 - del_timer_sync(&dev->timer_keyup);
31 - del_timer_sync(&dev->timer_repeat);
33 if (dev->driver_type == RC_DRIVER_IR_RAW)
34 ir_raw_event_unregister(dev);
36 + del_timer_sync(&dev->timer_keyup);
37 + del_timer_sync(&dev->timer_repeat);
39 rc_free_rx_device(dev);
41 mutex_lock(&dev->lock);