[media] s2255: Do not free fw_data until timer handler has actually stopped using it

Browse source

Function del_timer() does not guarantee that timer was really deleted.
If the timer handler is beeing executed at the moment, the function
does nothing. So, we have a race between del_timer() and kfree(), and
it's possible to use already freed memory in the handler.

Signed-off-by: Kirill Tkhai <tkhai@yandex.ru>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

...

This commit is contained in:

Kirill Tkhai 2014-04-17 17:47:04 -03:00 • committed by Mauro Carvalho Chehab

parent cd6ff5c2df

commit 9f6be2bc40

1 changed files with 2 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

drivers/media/usb/s2255/s2255drv.c

View file