As pointed out by Jonathan Corbet, the timer must be deleted before

flushing the work queue in order to avoid a job being submitted after the
chip had been released.

Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: "Serge E. Hallyn" <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 1 insertions, 1 deletions

diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 02a495c2e068..1fee7034a386 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1004,9 +1004,9 @@ int tpm_release(struct inode *inode, struct file *file)
 {
         struct tpm_chip *chip = file->private_data;
 
+        del_singleshot_timer_sync(&chip->user_read_timer);
         flush_scheduled_work();
         file->private_data = NULL;
-        del_singleshot_timer_sync(&chip->user_read_timer);
         atomic_set(&chip->data_pending, 0);
         kfree(chip->data_buffer);
         clear_bit(0, &chip->is_open);