Re: [PATCH] Input: hp_sdc: shut down kicker timer on module exit

[Helge Deller <deller@gmx.de>]

On 9/2/26 17:40, Runyu Xiao wrote:
> hp_sdc_kicker() rearms hp_sdc.kicker with mod_timer() after scheduling the
> tasklet.  The module exit path uses timer_delete_sync().  That waits for a
> callback already running but can still leave the timer rearmed.
> 
> A callback can therefore leave the timer pending while hp_sdc_exit() tears
> down the driver, allowing timer activity to access dismantled driver state.
> 
> Use timer_shutdown_sync() for final teardown.  It waits for a running
> callback and prevents rearming after module exit begins.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Acked-by: Helge Deller <deller@gmx.de>

Helge

> ---
>   drivers/input/serio/hp_sdc.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
> index 1461ef319..ecf5347b6 100644
> --- a/drivers/input/serio/hp_sdc.c
> +++ b/drivers/input/serio/hp_sdc.c
> @@ -981,7 +981,7 @@ static void hp_sdc_exit(void)
>   	free_irq(hp_sdc.irq, &hp_sdc);
>   	write_unlock_irq(&hp_sdc.lock);
>   
> -	timer_delete_sync(&hp_sdc.kicker);
> +	timer_shutdown_sync(&hp_sdc.kicker);
>   
>   	tasklet_kill(&hp_sdc.task);
>