* [PATCH 0/5] [media] cancel_delayed_work_sync before device removal / kfree
@ 2016-01-09 20:18 Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 1/5] [media] si2157: " Ernst Martin Witte
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Ernst Martin Witte @ 2016-01-09 20:18 UTC (permalink / raw
To: linux-media; +Cc: Ernst Martin Witte
For si2157, kernel panics in call_timer_fn could be triggered by
simply doing an
rmmod cx23885
A bisect identified commit 2f1ea29fca781b8e6600f3ece1f2dd98ae276294 as
the one introducing those kernel panics. It could be identified that
si2157_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(dev->stat_work).
Below drivers/media/tuners and drivers/media/dvb-frontends this issue
could also be identified in the following modules:
ts2020
af9013
af9033
rtl2830
Therefore, this patch series also includes the equivalent one-liner
fixes for these modules.
BR,
Martin
Ernst Martin Witte (5):
[media] si2157: cancel_delayed_work_sync before device removal / kfree
[media] ts2020: cancel_delayed_work_sync before device removal / kfree
[media] af9013: cancel_delayed_work_sync before device removal / kfree
[media] af9033: cancel_delayed_work_sync before device removal / kfree
[media] rtl2830: cancel_delayed_work_sync before device removal / kfree
drivers/media/dvb-frontends/af9013.c | 4 ++++
drivers/media/dvb-frontends/af9033.c | 3 +++
drivers/media/dvb-frontends/rtl2830.c | 3 +++
drivers/media/dvb-frontends/ts2020.c | 4 ++++
drivers/media/tuners/si2157.c | 3 +++
5 files changed, 17 insertions(+)
--
2.5.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/5] [media] si2157: cancel_delayed_work_sync before device removal / kfree
2016-01-09 20:18 [PATCH 0/5] [media] cancel_delayed_work_sync before device removal / kfree Ernst Martin Witte
@ 2016-01-09 20:18 ` Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 2/5] [media] ts2020: " Ernst Martin Witte
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Ernst Martin Witte @ 2016-01-09 20:18 UTC (permalink / raw
To: linux-media; +Cc: Ernst Martin Witte
si2157_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(dev->stat_work). This caused kernel panics in
call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
---
drivers/media/tuners/si2157.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
index ce157ed..bfb1d59 100644
--- a/drivers/media/tuners/si2157.c
+++ b/drivers/media/tuners/si2157.c
@@ -457,6 +457,9 @@ static int si2157_remove(struct i2c_client *client)
dev_dbg(&client->dev, "\n");
+ /* stop statistics polling */
+ cancel_delayed_work_sync(&dev->stat_work);
+
memset(&fe->ops.tuner_ops, 0, sizeof(struct dvb_tuner_ops));
fe->tuner_priv = NULL;
kfree(dev);
--
2.5.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/5] [media] ts2020: cancel_delayed_work_sync before device removal / kfree
2016-01-09 20:18 [PATCH 0/5] [media] cancel_delayed_work_sync before device removal / kfree Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 1/5] [media] si2157: " Ernst Martin Witte
@ 2016-01-09 20:18 ` Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 3/5] [media] af9013: " Ernst Martin Witte
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Ernst Martin Witte @ 2016-01-09 20:18 UTC (permalink / raw
To: linux-media; +Cc: Ernst Martin Witte
ts2020_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(dev->stat_work). A similar bug in si2157 caused
kernel panics in call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
---
drivers/media/dvb-frontends/ts2020.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/dvb-frontends/ts2020.c b/drivers/media/dvb-frontends/ts2020.c
index 7979e5d..14b410f 100644
--- a/drivers/media/dvb-frontends/ts2020.c
+++ b/drivers/media/dvb-frontends/ts2020.c
@@ -712,6 +712,10 @@ static int ts2020_remove(struct i2c_client *client)
dev_dbg(&client->dev, "\n");
+ /* stop statistics polling */
+ if (!dev->dont_poll)
+ cancel_delayed_work_sync(&dev->stat_work);
+
regmap_exit(dev->regmap);
kfree(dev);
return 0;
--
2.5.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 3/5] [media] af9013: cancel_delayed_work_sync before device removal / kfree
2016-01-09 20:18 [PATCH 0/5] [media] cancel_delayed_work_sync before device removal / kfree Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 1/5] [media] si2157: " Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 2/5] [media] ts2020: " Ernst Martin Witte
@ 2016-01-09 20:18 ` Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 4/5] [media] af9033: " Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 5/5] [media] rtl2830: " Ernst Martin Witte
4 siblings, 0 replies; 6+ messages in thread
From: Ernst Martin Witte @ 2016-01-09 20:18 UTC (permalink / raw
To: linux-media; +Cc: Ernst Martin Witte
af9013_remove was calling kfree(state) with possibly still active
schedule_delayed_work(&state->statistics_work). A similar bug in
si2157 caused kernel panics in call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
---
drivers/media/dvb-frontends/af9013.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
index e23197d..41ab5de 100644
--- a/drivers/media/dvb-frontends/af9013.c
+++ b/drivers/media/dvb-frontends/af9013.c
@@ -1344,6 +1344,10 @@ err:
static void af9013_release(struct dvb_frontend *fe)
{
struct af9013_state *state = fe->demodulator_priv;
+
+ /* stop statistics polling */
+ cancel_delayed_work_sync(&state->statistics_work);
+
kfree(state);
}
--
2.5.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 4/5] [media] af9033: cancel_delayed_work_sync before device removal / kfree
2016-01-09 20:18 [PATCH 0/5] [media] cancel_delayed_work_sync before device removal / kfree Ernst Martin Witte
` (2 preceding siblings ...)
2016-01-09 20:18 ` [PATCH 3/5] [media] af9013: " Ernst Martin Witte
@ 2016-01-09 20:18 ` Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 5/5] [media] rtl2830: " Ernst Martin Witte
4 siblings, 0 replies; 6+ messages in thread
From: Ernst Martin Witte @ 2016-01-09 20:18 UTC (permalink / raw
To: linux-media; +Cc: Ernst Martin Witte
af9033_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(&dev->stat_work). A similar bug in si2157
caused kernel panics in call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
---
drivers/media/dvb-frontends/af9033.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/dvb-frontends/af9033.c b/drivers/media/dvb-frontends/af9033.c
index bc35206..8b328d1 100644
--- a/drivers/media/dvb-frontends/af9033.c
+++ b/drivers/media/dvb-frontends/af9033.c
@@ -1372,6 +1372,9 @@ static int af9033_remove(struct i2c_client *client)
dev_dbg(&dev->client->dev, "\n");
+ /* stop statistics polling */
+ cancel_delayed_work_sync(&dev->stat_work);
+
dev->fe.ops.release = NULL;
dev->fe.demodulator_priv = NULL;
kfree(dev);
--
2.5.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 5/5] [media] rtl2830: cancel_delayed_work_sync before device removal / kfree
2016-01-09 20:18 [PATCH 0/5] [media] cancel_delayed_work_sync before device removal / kfree Ernst Martin Witte
` (3 preceding siblings ...)
2016-01-09 20:18 ` [PATCH 4/5] [media] af9033: " Ernst Martin Witte
@ 2016-01-09 20:18 ` Ernst Martin Witte
4 siblings, 0 replies; 6+ messages in thread
From: Ernst Martin Witte @ 2016-01-09 20:18 UTC (permalink / raw
To: linux-media; +Cc: Ernst Martin Witte
rtl2830_remove was calling kfree(dev) with possibly still active
schedule_delayed_work(&dev->stat_work). A similar bug in si2157
caused kernel panics in call_timer_fn e.g. after rmmod cx23885.
Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
---
drivers/media/dvb-frontends/rtl2830.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c
index b792f30..74b7712 100644
--- a/drivers/media/dvb-frontends/rtl2830.c
+++ b/drivers/media/dvb-frontends/rtl2830.c
@@ -900,6 +900,9 @@ static int rtl2830_remove(struct i2c_client *client)
dev_dbg(&client->dev, "\n");
+ /* stop statistics polling */
+ cancel_delayed_work_sync(&dev->stat_work);
+
i2c_del_mux_adapter(dev->adapter);
regmap_exit(dev->regmap);
kfree(dev);
--
2.5.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-01-09 20:24 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-01-09 20:18 [PATCH 0/5] [media] cancel_delayed_work_sync before device removal / kfree Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 1/5] [media] si2157: " Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 2/5] [media] ts2020: " Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 3/5] [media] af9013: " Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 4/5] [media] af9033: " Ernst Martin Witte
2016-01-09 20:18 ` [PATCH 5/5] [media] rtl2830: " Ernst Martin Witte
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).