7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sean Young commit ef41a67979aed4d7d4f393c56c1e25b6754e2b78 upstream. If rc_keydown() is called after rc_register_device(), then the timers can be re-armed. Delete them again for a final time. Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks") Signed-off-by: Sean Young Cc: stable@vger.kernel.org Acked-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/rc/rc-main.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/media/rc/rc-main.c +++ b/drivers/media/rc/rc-main.c @@ -1753,6 +1753,11 @@ void rc_free_device(struct rc_dev *dev) if (!dev) return; + if (dev->input_dev) { + timer_delete_sync(&dev->timer_keyup); + timer_delete_sync(&dev->timer_repeat); + } + input_put_device(dev->input_dev); put_device(&dev->dev);