]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
media: pulse8-cec: Handle partial deinit
authorVicki Pfau <vi@endrift.com>
Tue, 10 Mar 2026 04:50:34 +0000 (21:50 -0700)
committerHans Verkuil <hverkuil+cisco@kernel.org>
Mon, 16 Mar 2026 15:30:20 +0000 (16:30 +0100)
commit323f52e02be68889c8630c4a0415ef5b78f9dc63
tree1247036a28b3fc0bb40bb30fdc7d47e45f011dd8
parent68380ec2161ee61ce4f23001dfb536bbaa8f4979
media: pulse8-cec: Handle partial deinit

In the event that the cec dev node is held open while the adapter is
disconnected the serio device will be cleaned up but the cec device won't
be. As the serio device is freed but the ping_eeprom_work is not canceled,
the next ping will still attempt to send, leading to a kernel oops.

This patch both cancels the ping_eeprom_work in the serio cleanup as well
as checking to make sure the serio is still present before attempting to
write to it. Note that while the added serio = NULL line looks similar to
one that was removed in commit 024e01dead12c ("media: pulse8-cec: fix
duplicate free at disconnect or probe error"), it notably happens before
calling cec_unregister_adapter, and as such shouldn't lead to the
user-after-free that removing it fixed.

Signed-off-by: Vicki Pfau <vi@endrift.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
drivers/media/cec/usb/pulse8/pulse8-cec.c