linux/drivers/media/pci/mantis
Sean Young dccc0c3ddf media: rc: fix race between unregister and urb/irq callbacks
Some rc device drivers have a race condition between rc_unregister_device()
and irq or urb callbacks. This is because rc_unregister_device() does two
things, it marks the device as unregistered so no new commands can be
issued and then it calls rc_free_device(). This means the driver has no
chance to cancel any pending urb callbacks or interrupts after the device
has been marked as unregistered. Those callbacks may access struct rc_dev
or its members (e.g. struct ir_raw_event_ctrl), which have been freed by
rc_free_device().

This change removes the implicit call to rc_free_device() from
rc_unregister_device(). This means that device drivers can call
rc_unregister_device() in their remove or disconnect function, then cancel
all the urbs and interrupts before explicitly calling rc_free_device().

Note this is an alternative fix for an issue found by Haotian Zhang, see
the Closes: tags.

Reported-by: Haotian Zhang <vulab@iscas.ac.cn>
Closes: https://lore.kernel.org/linux-media/20251114101432.2566-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114101418.2548-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114101346.2530-1-vulab@iscas.ac.cn/
Closes: https://lore.kernel.org/linux-media/20251114090605.2413-1-vulab@iscas.ac.cn/
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-03-17 14:43:56 +01:00
..
hopper_cards.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hopper_vp3028.c
hopper_vp3028.h
Kconfig
Makefile
mantis_ca.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mantis_ca.h
mantis_cards.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mantis_common.h
mantis_dma.c
mantis_dma.h
mantis_dvb.c
mantis_dvb.h
mantis_evm.c
mantis_hif.c
mantis_hif.h
mantis_i2c.c
mantis_i2c.h
mantis_input.c media: rc: fix race between unregister and urb/irq callbacks 2026-03-17 14:43:56 +01:00
mantis_input.h
mantis_ioc.c
mantis_ioc.h
mantis_link.h
mantis_pci.c
mantis_pci.h
mantis_pcmcia.c
mantis_reg.h
mantis_uart.c
mantis_uart.h
mantis_vp1033.c
mantis_vp1033.h
mantis_vp1034.c
mantis_vp1034.h
mantis_vp1041.c
mantis_vp1041.h
mantis_vp2033.c
mantis_vp2033.h
mantis_vp2040.c
mantis_vp2040.h
mantis_vp3030.c
mantis_vp3030.h