[PATCH] tty: ipwireless: shut down setup timer before freeing hardware

[Hongyan Xu <getshell@seu.edu.cn>]

ipwireless_stop_interrupts() uses timer_delete() for a timer whose callback
can rearm itself. timer_delete() neither waits for a running callback nor
prevents that callback from rearming the timer. The callback can therefore
continue to access struct ipw_hardware after ipwireless_hardware_free() has
freed it.

Use timer_shutdown_sync() so teardown waits for the callback and prevents
any further rearming.

Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
Cc: stable@vger.kernel.org
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/tty/ipwireless/hardware.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
index 0bfcbca6e2df..fb3554a6e04b 100644
--- a/drivers/tty/ipwireless/hardware.c
+++ b/drivers/tty/ipwireless/hardware.c
@@ -1721,7 +1721,7 @@ void ipwireless_stop_interrupts(struct ipw_hardware *hw)
 	if (!hw->shutting_down) {
 		/* Tell everyone we are going down. */
 		hw->shutting_down = 1;
-		timer_delete(&hw->setup_timer);
+		timer_shutdown_sync(&hw->setup_timer);
 
 		/* Prevent the hardware from sending any more interrupts */
 		do_close_hardware(hw);
-- 
2.50.1.windows.1