diff options
author | Jean Delvare <khali@linux-fr.org> | 2009-03-07 05:44:12 -0500 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2009-03-30 11:43:17 -0400 |
commit | fb6991d417a9f06978119ea597dc5955b3eb784d (patch) | |
tree | 9c147ebcb96244536a0fe4c8f2cce2a9f5210712 /drivers/media | |
parent | c1089bdc07f06b90f0bc50d0789c2a4833097df7 (diff) |
V4L/DVB (10940): saa6588: Prevent general protection fault on rmmod
The removal of the timer which polls the infrared input is racy.
Replacing the timer with a delayed work solves the problem.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
-rw-r--r-- | drivers/media/video/saa6588.c | 24 |
1 files changed, 6 insertions, 18 deletions
diff --git a/drivers/media/video/saa6588.c b/drivers/media/video/saa6588.c index 0067b281d50..2ce758c1ebb 100644 --- a/drivers/media/video/saa6588.c +++ b/drivers/media/video/saa6588.c | |||
@@ -76,8 +76,7 @@ MODULE_LICENSE("GPL"); | |||
76 | 76 | ||
77 | struct saa6588 { | 77 | struct saa6588 { |
78 | struct v4l2_subdev sd; | 78 | struct v4l2_subdev sd; |
79 | struct work_struct work; | 79 | struct delayed_work work; |
80 | struct timer_list timer; | ||
81 | spinlock_t lock; | 80 | spinlock_t lock; |
82 | unsigned char *buffer; | 81 | unsigned char *buffer; |
83 | unsigned int buf_size; | 82 | unsigned int buf_size; |
@@ -322,19 +321,12 @@ static void saa6588_i2c_poll(struct saa6588 *s) | |||
322 | wake_up_interruptible(&s->read_queue); | 321 | wake_up_interruptible(&s->read_queue); |
323 | } | 322 | } |
324 | 323 | ||
325 | static void saa6588_timer(unsigned long data) | ||
326 | { | ||
327 | struct saa6588 *s = (struct saa6588 *)data; | ||
328 | |||
329 | schedule_work(&s->work); | ||
330 | } | ||
331 | |||
332 | static void saa6588_work(struct work_struct *work) | 324 | static void saa6588_work(struct work_struct *work) |
333 | { | 325 | { |
334 | struct saa6588 *s = container_of(work, struct saa6588, work); | 326 | struct saa6588 *s = container_of(work, struct saa6588, work.work); |
335 | 327 | ||
336 | saa6588_i2c_poll(s); | 328 | saa6588_i2c_poll(s); |
337 | mod_timer(&s->timer, jiffies + msecs_to_jiffies(20)); | 329 | schedule_delayed_work(&s->work, msecs_to_jiffies(20)); |
338 | } | 330 | } |
339 | 331 | ||
340 | static int saa6588_configure(struct saa6588 *s) | 332 | static int saa6588_configure(struct saa6588 *s) |
@@ -490,11 +482,8 @@ static int saa6588_probe(struct i2c_client *client, | |||
490 | saa6588_configure(s); | 482 | saa6588_configure(s); |
491 | 483 | ||
492 | /* start polling via eventd */ | 484 | /* start polling via eventd */ |
493 | INIT_WORK(&s->work, saa6588_work); | 485 | INIT_DELAYED_WORK(&s->work, saa6588_work); |
494 | init_timer(&s->timer); | 486 | schedule_delayed_work(&s->work, 0); |
495 | s->timer.function = saa6588_timer; | ||
496 | s->timer.data = (unsigned long)s; | ||
497 | schedule_work(&s->work); | ||
498 | return 0; | 487 | return 0; |
499 | } | 488 | } |
500 | 489 | ||
@@ -505,8 +494,7 @@ static int saa6588_remove(struct i2c_client *client) | |||
505 | 494 | ||
506 | v4l2_device_unregister_subdev(sd); | 495 | v4l2_device_unregister_subdev(sd); |
507 | 496 | ||
508 | del_timer_sync(&s->timer); | 497 | cancel_delayed_work_sync(&s->work); |
509 | flush_scheduled_work(); | ||
510 | 498 | ||
511 | kfree(s->buffer); | 499 | kfree(s->buffer); |
512 | kfree(s); | 500 | kfree(s); |