Re: [PATCH] tty: ipwireless: shut down setup timer before freeing hardware
Greg Kroah-Hartman <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.linux-kernel,org.kernel.vger.linux-serial |
|---|---|
| Message-ID | <2026080627-uncrushed-boil-769d@gregkh> |
On Thu, Aug 06, 2026 at 02:07:40PM +0800, Hongyan Xu wrote:
> ipwireless_stop_interrupts() uses timer_delete() for a timer whose callback
> can rearm itself. timer_delete() neither waits for a running callback nor
> prevents that callback from rearming the timer. The callback can therefore
> continue to access struct ipw_hardware after ipwireless_hardware_free() has
> freed it.
>
> Use timer_shutdown_sync() so teardown waits for the callback and prevents
> any further rearming.
>
> Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
> Cc: [email protected]
> Signed-off-by: Hongyan Xu <[email protected]>
> ---
> drivers/tty/ipwireless/hardware.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
> index 0bfcbca6e2df..fb3554a6e04b 100644
> --- a/drivers/tty/ipwireless/hardware.c
> +++ b/drivers/tty/ipwireless/hardware.c
> @@ -1721,7 +1721,7 @@ void ipwireless_stop_interrupts(struct ipw_hardware *hw)
> if (!hw->shutting_down) {
> /* Tell everyone we are going down. */
> hw->shutting_down = 1;
> - timer_delete(&hw->setup_timer);
> + timer_shutdown_sync(&hw->setup_timer);
>
> /* Prevent the hardware from sending any more interrupts */
> do_close_hardware(hw);
> --
> 2.50.1.windows.1
>
How was this tested?