mirror of
https://github.com/torvalds/linux.git
synced 2026-05-13 00:28:54 +02:00
Some rc device drivers have a race condition between rc_unregister_device() and irq or urb callbacks. This is because rc_unregister_device() does two things, it marks the device as unregistered so no new commands can be issued and then it calls rc_free_device(). This means the driver has no chance to cancel any pending urb callbacks or interrupts after the device has been marked as unregistered. Those callbacks may access struct rc_dev or its members (e.g. struct ir_raw_event_ctrl), which have been freed by rc_free_device(). This change removes the implicit call to rc_free_device() from rc_unregister_device(). This means that device drivers can call rc_unregister_device() in their remove or disconnect function, then cancel all the urbs and interrupts before explicitly calling rc_free_device(). Note this is an alternative fix for an issue found by Haotian Zhang, see the Closes: tags. Reported-by: Haotian Zhang <vulab@iscas.ac.cn> Closes: https://lore.kernel.org/linux-media/20251114101432.2566-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101418.2548-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101346.2530-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114090605.2413-1-vulab@iscas.ac.cn/ Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> |
||
|---|---|---|
| .. | ||
| hopper_cards.c | ||
| hopper_vp3028.c | ||
| hopper_vp3028.h | ||
| Kconfig | ||
| Makefile | ||
| mantis_ca.c | ||
| mantis_ca.h | ||
| mantis_cards.c | ||
| mantis_common.h | ||
| mantis_dma.c | ||
| mantis_dma.h | ||
| mantis_dvb.c | ||
| mantis_dvb.h | ||
| mantis_evm.c | ||
| mantis_hif.c | ||
| mantis_hif.h | ||
| mantis_i2c.c | ||
| mantis_i2c.h | ||
| mantis_input.c | ||
| mantis_input.h | ||
| mantis_ioc.c | ||
| mantis_ioc.h | ||
| mantis_link.h | ||
| mantis_pci.c | ||
| mantis_pci.h | ||
| mantis_pcmcia.c | ||
| mantis_reg.h | ||
| mantis_uart.c | ||
| mantis_uart.h | ||
| mantis_vp1033.c | ||
| mantis_vp1033.h | ||
| mantis_vp1034.c | ||
| mantis_vp1034.h | ||
| mantis_vp1041.c | ||
| mantis_vp1041.h | ||
| mantis_vp2033.c | ||
| mantis_vp2033.h | ||
| mantis_vp2040.c | ||
| mantis_vp2040.h | ||
| mantis_vp3030.c | ||
| mantis_vp3030.h | ||