Commit 2a774594 authored by Oliver Neukum's avatar Oliver Neukum Committed by Mauro Carvalho Chehab
Browse files

media: igorplugusb: break cyclical race on disconnect 



The driver uses a timer, that may submit the URB and
the URB may start the timer. No simple order of killing
can break te cycle. Poison the URB before killing
the timer.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent 522f1d7d

drivers/media/rc/igorplugusb.c

+5 −2
Original line number Diff line number Diff line
@@ -126,7 +126,7 @@ static void igorplugusb_cmd(struct igorplugusb *ir, int cmd) 
	ir->request.bRequest = cmd;

	ir->urb->transfer_flags = 0;

	ret = usb_submit_urb(ir->urb, GFP_ATOMIC);

	if (ret)

	if (ret && ret != -EPERM)

		dev_err(ir->dev, "submit urb failed: %d", ret);

}
@@ -223,7 +223,9 @@ static int igorplugusb_probe(struct usb_interface *intf, 


	return 0;

fail:

	usb_poison_urb(ir->urb);

	del_timer(&ir->timer);

	usb_unpoison_urb(ir->urb);

	usb_free_urb(ir->urb);

	rc_free_device(ir->rc);

	kfree(ir->buf_in);
@@ -236,9 +238,10 @@ static void igorplugusb_disconnect(struct usb_interface *intf) 
	struct igorplugusb *ir = usb_get_intfdata(intf);



	rc_unregister_device(ir->rc);

	usb_poison_urb(ir->urb);

	del_timer_sync(&ir->timer);

	usb_set_intfdata(intf, NULL);

	usb_kill_urb(ir->urb);

	usb_unpoison_urb(ir->urb);

	usb_free_urb(ir->urb);

	kfree(ir->buf_in);

}