Commit 9f6be2bc authored by Kirill Tkhai's avatar Kirill Tkhai Committed by Mauro Carvalho Chehab
Browse files

[media] s2255: Do not free fw_data until timer handler has actually stopped using it 



Function del_timer() does not guarantee that timer was really deleted.
If the timer handler is beeing executed at the moment, the function
does nothing. So, we have a race between del_timer() and kfree(), and
it's possible to use already freed memory in the handler.

Signed-off-by: default avatarKirill Tkhai <tkhai@yandex.ru>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <m.chehab@samsung.com>
parent cd6ff5c2

drivers/media/usb/s2255/s2255drv.c

+2 −2
Original line number Diff line number Diff line
@@ -1521,7 +1521,7 @@ static void s2255_destroy(struct s2255_dev *dev) 
	/* board shutdown stops the read pipe if it is running */

	s2255_board_shutdown(dev);

	/* make sure firmware still not trying to load */

	del_timer(&dev->timer);  /* only started in .probe and .open */

	del_timer_sync(&dev->timer);  /* only started in .probe and .open */

	if (dev->fw_data->fw_urb) {

		usb_kill_urb(dev->fw_data->fw_urb);

		usb_free_urb(dev->fw_data->fw_urb);
@@ -2351,7 +2351,7 @@ static int s2255_probe(struct usb_interface *interface, 
errorFWDATA2:

	usb_free_urb(dev->fw_data->fw_urb);

errorFWURB:

	del_timer(&dev->timer);

	del_timer_sync(&dev->timer);

errorEP:

	usb_put_dev(dev->udev);

errorUDEV: