[PATCH v4 16/19] media: rc: After rc_unregister_device() timers can be re-armed

From: Sean Young

Date: Tue Sep 08 2026 - 12:01:57 EST


If rc_keydown() is called after rc_register_device(), then the timers
can be re-armed.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@xxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
drivers/media/rc/rc-main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 795ac0fe4858..088d935d8347 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -2065,8 +2065,8 @@ void rc_unregister_device(struct rc_dev *dev)
if (dev->driver_type == RC_DRIVER_IR_RAW)
ir_raw_event_unregister(dev);

- timer_delete_sync(&dev->timer_keyup);
- timer_delete_sync(&dev->timer_repeat);
+ timer_shutdown_sync(&dev->timer_keyup);
+ timer_shutdown_sync(&dev->timer_repeat);

rc_free_rx_device(dev);

--
2.55.0