From ef41a67979aed4d7d4f393c56c1e25b6754e2b78 Mon Sep 17 00:00:00 2001 From: Sean Young Date: Fri, 4 Sep 2026 14:07:44 +0100 Subject: [PATCH] media: rc: After rc_unregister_device() timers can be re-armed If rc_keydown() is called after rc_register_device(), then the timers can be re-armed. Delete them again for a final time. Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks") Signed-off-by: Sean Young Cc: stable@vger.kernel.org Acked-by: Hans Verkuil --- drivers/media/rc/rc-main.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c index ed746255b0a2..1c07bdd3b42b 100644 --- a/drivers/media/rc/rc-main.c +++ b/drivers/media/rc/rc-main.c @@ -1785,6 +1785,11 @@ void rc_free_device(struct rc_dev *dev) if (!dev) return; + if (dev->input_dev) { + timer_delete_sync(&dev->timer_keyup); + timer_delete_sync(&dev->timer_repeat); + } + input_put_device(dev->input_dev); put_device(&dev->dev);