mirror of
https://github.com/torvalds/linux.git
synced 2026-09-20 01:20:03 +02:00
dccc0c3ddf
Some rc device drivers have a race condition between rc_unregister_device() and irq or urb callbacks. This is because rc_unregister_device() does two things, it marks the device as unregistered so no new commands can be issued and then it calls rc_free_device(). This means the driver has no chance to cancel any pending urb callbacks or interrupts after the device has been marked as unregistered. Those callbacks may access struct rc_dev or its members (e.g. struct ir_raw_event_ctrl), which have been freed by rc_free_device(). This change removes the implicit call to rc_free_device() from rc_unregister_device(). This means that device drivers can call rc_unregister_device() in their remove or disconnect function, then cancel all the urbs and interrupts before explicitly calling rc_free_device(). Note this is an alternative fix for an issue found by Haotian Zhang, see the Closes: tags. Reported-by: Haotian Zhang <vulab@iscas.ac.cn> Closes: https://lore.kernel.org/linux-media/20251114101432.2566-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101418.2548-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114101346.2530-1-vulab@iscas.ac.cn/ Closes: https://lore.kernel.org/linux-media/20251114090605.2413-1-vulab@iscas.ac.cn/ Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org> |
||
|---|---|---|
| .. | ||
| af9015.c | ||
| af9015.h | ||
| af9035.c | ||
| af9035.h | ||
| anysee.c | ||
| anysee.h | ||
| au6610.c | ||
| au6610.h | ||
| az6007.c | ||
| ce6230.c | ||
| ce6230.h | ||
| dvb_usb_common.h | ||
| dvb_usb_core.c | ||
| dvb_usb_urb.c | ||
| dvb_usb.h | ||
| dvbsky.c | ||
| ec168.c | ||
| ec168.h | ||
| gl861.c | ||
| Kconfig | ||
| lmedm04.c | ||
| lmedm04.h | ||
| Makefile | ||
| mxl111sf-demod.c | ||
| mxl111sf-demod.h | ||
| mxl111sf-gpio.c | ||
| mxl111sf-gpio.h | ||
| mxl111sf-i2c.c | ||
| mxl111sf-i2c.h | ||
| mxl111sf-phy.c | ||
| mxl111sf-phy.h | ||
| mxl111sf-reg.h | ||
| mxl111sf-tuner.c | ||
| mxl111sf-tuner.h | ||
| mxl111sf.c | ||
| mxl111sf.h | ||
| rtl28xxu.c | ||
| rtl28xxu.h | ||
| usb_urb.c | ||
| zd1301.c | ||