diff options
| author | Sean Young <sean@mess.org> | 2026-09-01 10:34:51 +0100 |
|---|---|---|
| committer | Sean Young <sean@mess.org> | 2026-09-22 14:50:16 +0100 |
| commit | b3f5daf3222999d3f92f606a4eb5e35ab90fd0e4 (patch) | |
| tree | 6e5c3839552413ba42bf5ee30d652c32cc64cce4 /drivers | |
| parent | ab9567336171e46ce9e03ee126902b3fd7901baa (diff) | |
media: rc: Fix race between bpf(BPG_PROG_ATTACH) and device unregister
Mark the device as unregistered before tearing down raw IR/bpf
state, so that racing bpf(BPF_PROG_{ATTACH,DETACH,QUERY}) calls
cannot slip in between ir_raw_event_unregister() completing and
dev->registered being cleared.
Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
Acked-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/rc/rc-main.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c index 67d86b8ea5e0..37ba19164875 100644 --- a/drivers/media/rc/rc-main.c +++ b/drivers/media/rc/rc-main.c @@ -2056,18 +2056,18 @@ void rc_unregister_device(struct rc_dev *dev) if (!dev) return; + mutex_lock(&dev->lock); + dev->registered = false; + if (dev->users && dev->close) + dev->close(dev); + mutex_unlock(&dev->lock); + if (dev->driver_type == RC_DRIVER_IR_RAW) ir_raw_event_unregister(dev); timer_delete_sync(&dev->timer_keyup); timer_delete_sync(&dev->timer_repeat); - mutex_lock(&dev->lock); - if (dev->users && dev->close) - dev->close(dev); - dev->registered = false; - mutex_unlock(&dev->lock); - rc_free_rx_device(dev); /* |