[PATCH] media: rc: Fix simulated TX timer lifecycle

[Runyu Xiao]

The ENE driver only initializes tx_sim_timer when TX simulation is
enabled for hardware without native TX support.  However, ene_remove()
passes the timer to timer_delete_sync() unconditionally, and
ene_tx_sample() uses the global txsim parameter when deciding whether to
arm it.  Thus a normal device, or a device with native TX support and
txsim enabled, can operate on an uninitialized timer.

Track whether simulation was actually enabled for each device and use
that state for timer arming and teardown.  Since the simulation callback
rearms the timer, shut it down permanently before freeing the device.

Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@xxxxxxxxxx>
---
 drivers/media/rc/ene_ir.c | 6 ++++--
 drivers/media/rc/ene_ir.h | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index 6f7dccc96..9d0279667 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -652,7 +652,7 @@ static void ene_tx_sample(struct ene_device *dev)
 	dev->tx_reg = !dev->tx_reg;
 exit:
 	/* simulate TX done interrupt */
-	if (txsim)
+	if (dev->tx_sim_enabled)
 		mod_timer(&dev->tx_sim_timer, jiffies + HZ / 500);
 }
 
@@ -1032,6 +1032,7 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
 
 	if (!dev->hw_learning_and_tx_capable && txsim) {
 		dev->hw_learning_and_tx_capable = true;
+		dev->tx_sim_enabled = true;
 		timer_setup(&dev->tx_sim_timer, ene_tx_irqsim, 0);
 		pr_warn("Simulation of TX activated\n");
 	}
@@ -1103,7 +1104,8 @@ static void ene_remove(struct pnp_dev *pnp_dev)
 	unsigned long flags;
 
 	rc_unregister_device(dev->rdev);
-	timer_delete_sync(&dev->tx_sim_timer);
+	if (dev->tx_sim_enabled)
+		timer_shutdown_sync(&dev->tx_sim_timer);
 	spin_lock_irqsave(&dev->hw_lock, flags);
 	ene_rx_disable(dev);
 	ene_rx_restore_hw_buffer(dev);
diff --git a/drivers/media/rc/ene_ir.h b/drivers/media/rc/ene_ir.h
index c1c44e86e..f44cbc034 100644
--- a/drivers/media/rc/ene_ir.h
+++ b/drivers/media/rc/ene_ir.h
@@ -218,6 +218,7 @@ struct ene_device {
 	int tx_done;				/* done transmitting */
 						/* one more sample pending*/
 	struct completion tx_complete;		/* TX completion */
+	bool tx_sim_enabled;			/* simulated TX is enabled */
 	struct timer_list tx_sim_timer;
 
 	/* TX settings */
-- 
2.34.1