V4L/DVB (10943): cx88: Prevent general protection fault on rmmod

When unloading the cx8800 driver I sometimes get a general protection
fault. Analysis revealed a race in cx88_ir_stop(). It can be solved by
using a delayed work instead of a timer for infrared input polling.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

1 files changed, 7 insertions, 18 deletions

diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index ad0842136d8..ec05312a9b6 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -48,8 +48,7 @@ struct cx88_IR {
 
         /* poll external decoder */
         int polling;
-        struct work_struct work;
-        struct timer_list timer;
+        struct delayed_work work;
         u32 gpio_addr;
         u32 last_gpio;
         u32 mask_keycode;
@@ -143,27 +142,19 @@ static void cx88_ir_handle_key(struct cx88_IR *ir)
         }
 }
 
-static void ir_timer(unsigned long data)
-{
-        struct cx88_IR *ir = (struct cx88_IR *)data;
-
-        schedule_work(&ir->work);
-}
-
 static void cx88_ir_work(struct work_struct *work)
 {
-        struct cx88_IR *ir = container_of(work, struct cx88_IR, work);
+        struct cx88_IR *ir = container_of(work, struct cx88_IR, work.work);
 
         cx88_ir_handle_key(ir);
-        mod_timer(&ir->timer, jiffies + msecs_to_jiffies(ir->polling));
+        schedule_delayed_work(&ir->work, msecs_to_jiffies(ir->polling));
 }
 
 void cx88_ir_start(struct cx88_core *core, struct cx88_IR *ir)
 {
         if (ir->polling) {
-                setup_timer(&ir->timer, ir_timer, (unsigned long)ir);
-                INIT_WORK(&ir->work, cx88_ir_work);
-                schedule_work(&ir->work);
+                INIT_DELAYED_WORK(&ir->work, cx88_ir_work);
+                schedule_delayed_work(&ir->work, 0);
         }
         if (ir->sampling) {
                 core->pci_irqmask |= PCI_INT_IR_SMPINT;
@@ -179,10 +170,8 @@ void cx88_ir_stop(struct cx88_core *core, struct cx88_IR *ir)
                 core->pci_irqmask &= ~PCI_INT_IR_SMPINT;
         }
 
-        if (ir->polling) {
-                del_timer_sync(&ir->timer);
-                flush_scheduled_work();
-        }
+        if (ir->polling)
+                cancel_delayed_work_sync(&ir->work);
 }
 
 /* ---------------------------------------------------------------------- */