From patchwork Fri Feb 14 11:47:57 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kirill Tkhai X-Patchwork-Id: 3652211 X-Patchwork-Delegate: tiwai@suse.de Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 5C3FEBF13A for ; Fri, 14 Feb 2014 11:57:17 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id B0DD420115 for ; Fri, 14 Feb 2014 11:57:12 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id A3FDC201CE for ; Fri, 14 Feb 2014 11:57:10 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id 787C426531A; Fri, 14 Feb 2014 12:57:09 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from alsa0.perex.cz (localhost [IPv6:::1]) by alsa0.perex.cz (Postfix) with ESMTP id 453EB261609; Fri, 14 Feb 2014 12:56:59 +0100 (CET) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id A90FC26160F; Fri, 14 Feb 2014 12:47:48 +0100 (CET) Received: from relay.parallels.com (relay.parallels.com [195.214.232.42]) by alsa0.perex.cz (Postfix) with ESMTP id EFC84261609 for ; Fri, 14 Feb 2014 12:47:41 +0100 (CET) Received: from [10.30.3.11] (helo=mail.sw.ru) by relay.parallels.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.82) (envelope-from ) id 1WEHF2-00080z-I6; Fri, 14 Feb 2014 15:47:36 +0400 Received: from [10.30.26.172] (10.30.26.172) by mail.sw.ru (10.30.3.11) with Microsoft SMTP Server (TLS) id 14.3.174.1; Fri, 14 Feb 2014 15:47:35 +0400 Message-ID: <1392378477.5384.29.camel@tkhai> From: Kirill Tkhai To: Jaroslav Kysela , Takashi Iwai Date: Fri, 14 Feb 2014 15:47:57 +0400 Organization: Parallels X-Mailer: Evolution 3.4.4-3 MIME-Version: 1.0 X-Originating-IP: [10.30.26.172] X-Mailman-Approved-At: Fri, 14 Feb 2014 12:56:57 +0100 Cc: tkhai@yandex.ru, alsa-devel@alsa-project.org Subject: [alsa-devel] [PATCH] ak4117: Do not free priv until timer handler hasn't actually stopped using it X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP Function del_timer() does not guarantee that timer was really deleted. If the timer handler is beeing executed at the moment, the function does nothing. So, it's possible to use already freed memory in the handler: [ref: Documentation/DocBook/kernel-locking.tmpl] This was found using grep and compile-tested only. Signed-off-by: Kirill Tkhai CC: Jaroslav Kysela CC: Takashi Iwai --- sound/i2c/other/ak4117.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/i2c/other/ak4117.c b/sound/i2c/other/ak4117.c index 40e33c9..88452e8 100644 --- a/sound/i2c/other/ak4117.c +++ b/sound/i2c/other/ak4117.c @@ -62,7 +62,7 @@ static void reg_dump(struct ak4117 *ak4117) static void snd_ak4117_free(struct ak4117 *chip) { - del_timer(&chip->timer); + del_timer_sync(&chip->timer); kfree(chip); }