[PATCH v3 15/17] media: serial_ir: Fix race condition where timer can be re-armed

[Sean Young]

Ensure the timer is deleted after the irq is freed, but before rcdev.

Fixes: 2940c7e49775 ("[media] serial_ir: generate timeout")
Signed-off-by: Sean Young <sean@xxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
 drivers/media/rc/serial_ir.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
index 992fff82b524..35741a8da63a 100644
--- a/drivers/media/rc/serial_ir.c
+++ b/drivers/media/rc/serial_ir.c
@@ -481,6 +481,11 @@ static int serial_ir_tx_carrier(struct rc_dev *dev, u32 carrier);
 static int serial_ir_open(struct rc_dev *rcdev);
 static void serial_ir_close(struct rc_dev *rcdev);
 
+static void devm_timer_delete_sync(void *timer)
+{
+	timer_delete_sync(timer);
+}
+
 static int serial_ir_probe(struct platform_device *dev)
 {
 	struct rc_dev *rcdev;
@@ -535,6 +540,11 @@ static int serial_ir_probe(struct platform_device *dev)
 
 	timer_setup(&serial_ir.timeout_timer, serial_ir_timeout, 0);
 
+	result = devm_add_action_or_reset(&dev->dev, devm_timer_delete_sync,
+					  &serial_ir.timeout_timer);
+	if (result)
+		return result;
+
 	result = devm_request_irq(&dev->dev, irq, serial_ir_irq_handler,
 				  share_irq ? IRQF_SHARED : 0,
 				  KBUILD_MODNAME, &hardware);
@@ -798,7 +808,6 @@ static int __init serial_ir_init_module(void)
 
 static void __exit serial_ir_exit_module(void)
 {
-	timer_delete_sync(&serial_ir.timeout_timer);
 	serial_ir_exit();
 }
 
-- 
2.55.0