diff options
| author | Kirill Tkhai <tkhai@yandex.ru> | 2014-04-17 17:47:04 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <m.chehab@samsung.com> | 2014-05-23 12:16:39 -0300 |
| commit | 9f6be2bc403c0cea8d7b72cd5d42bd1a22b369ed (patch) | |
| tree | 8174f22b98e60fb5d0de5a2c4b1b623902e18f77 /drivers/staging/media/bcm2048/radio-bcm2048.c | |
| parent | cd6ff5c2dfb3f17e3b900738533a7f82a2030746 (diff) | |
[media] s2255: Do not free fw_data until timer handler has actually stopped using it
Function del_timer() does not guarantee that timer was really deleted.
If the timer handler is beeing executed at the moment, the function
does nothing. So, we have a race between del_timer() and kfree(), and
it's possible to use already freed memory in the handler.
Signed-off-by: Kirill Tkhai <tkhai@yandex.ru>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Diffstat (limited to 'drivers/staging/media/bcm2048/radio-bcm2048.c')
0 files changed, 0 insertions, 0 deletions