7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sean Young [ Upstream commit ae6cfbad7ca346b78f4cdac38438bbfaed8c18a0 ] The timer can be re-armed from the irq, so ensure that the timers are deleted after the irq and that we only free the rc device once we are sure that the irq has been silenced. Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks") Cc: stable@vger.kernel.org Signed-off-by: Sean Young Acked-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/rc/ene_ir.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c index 6f7dccc965e7f..f98d76277b62a 100644 --- a/drivers/media/rc/ene_ir.c +++ b/drivers/media/rc/ene_ir.c @@ -1103,15 +1103,15 @@ static void ene_remove(struct pnp_dev *pnp_dev) unsigned long flags; rc_unregister_device(dev->rdev); - timer_delete_sync(&dev->tx_sim_timer); spin_lock_irqsave(&dev->hw_lock, flags); ene_rx_disable(dev); ene_rx_restore_hw_buffer(dev); spin_unlock_irqrestore(&dev->hw_lock, flags); - rc_free_device(dev->rdev); free_irq(dev->irq, dev); + timer_delete_sync(&dev->tx_sim_timer); release_region(dev->hw_io, ENE_IO_SIZE); + rc_free_device(dev->rdev); kfree(dev); } -- 2.53.0