s2255: Do not free fw_data until timer handler has actually stopped using it
PATCH 1/1 s2255: Do not free fw_data until timer handler has actually stopped using it
Function del_timer() does not guarantee that timer was really deleted. If the timer handler is beeing executed at the moment, the function does nothing. So, we have a race between del_timer() and kfree(), and it's possible to use already freed memory in the handler.
This is compile-tested only. Please, consider applying or something like it.
[Should CC stable@ ?]
Signed-off-by Kirill Tkhai <[email protected]>
--- drivers/media/usb/s2255/s2255drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/usb/s2255/s2255drv.c +2 -2
@@ -1522,7 +1522,7 @@ static void s2255_destroy(struct s2255_dev *dev)/* board shutdown stops the read pipe if it is running */ s2255_board_shutdown (dev);/* make sure firmware still not trying to load */ -del_timer (&dev->timer);/* only started in .probe and .open */ +del_timer_sync (&dev->timer);/* only started in .probe and .open */ if (dev->fw_data->fw_urb) {usb_kill_urb (dev->fw_data->fw_urb);usb_free_urb (dev->fw_data->fw_urb);
@@ -2352,7 +2352,7 @@ errorREQFW: errorFWDATA2:usb_free_urb (dev->fw_data->fw_urb); errorFWURB: -del_timer (&dev->timer); +del_timer_sync (&dev->timer); errorEP:usb_put_dev (dev->udev); errorUDEV: