* [PATCH] tty: ipwireless: shut down setup timer before freeing hardware
@ 2026-08-06 6:07 Hongyan Xu
2026-08-06 6:16 ` Greg Kroah-Hartman
2026-08-06 7:54 ` Jiri Kosina
0 siblings, 2 replies; 3+ messages in thread
From: Hongyan Xu @ 2026-08-06 6:07 UTC (permalink / raw)
To: Jiri Kosina, David Sterba, Greg Kroah-Hartman, Jiri Slaby
Cc: Ben Martel, Stephen Blackheath, linux-kernel, linux-serial,
stable, jianhao.xu, Hongyan Xu
ipwireless_stop_interrupts() uses timer_delete() for a timer whose callback
can rearm itself. timer_delete() neither waits for a running callback nor
prevents that callback from rearming the timer. The callback can therefore
continue to access struct ipw_hardware after ipwireless_hardware_free() has
freed it.
Use timer_shutdown_sync() so teardown waits for the callback and prevents
any further rearming.
Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
Cc: stable@vger.kernel.org
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
drivers/tty/ipwireless/hardware.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
index 0bfcbca6e2df..fb3554a6e04b 100644
--- a/drivers/tty/ipwireless/hardware.c
+++ b/drivers/tty/ipwireless/hardware.c
@@ -1721,7 +1721,7 @@ void ipwireless_stop_interrupts(struct ipw_hardware *hw)
if (!hw->shutting_down) {
/* Tell everyone we are going down. */
hw->shutting_down = 1;
- timer_delete(&hw->setup_timer);
+ timer_shutdown_sync(&hw->setup_timer);
/* Prevent the hardware from sending any more interrupts */
do_close_hardware(hw);
--
2.50.1.windows.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] tty: ipwireless: shut down setup timer before freeing hardware
2026-08-06 6:07 [PATCH] tty: ipwireless: shut down setup timer before freeing hardware Hongyan Xu
@ 2026-08-06 6:16 ` Greg Kroah-Hartman
2026-08-06 7:54 ` Jiri Kosina
1 sibling, 0 replies; 3+ messages in thread
From: Greg Kroah-Hartman @ 2026-08-06 6:16 UTC (permalink / raw)
To: Hongyan Xu
Cc: Jiri Kosina, David Sterba, Jiri Slaby, Ben Martel,
Stephen Blackheath, linux-kernel, linux-serial, stable,
jianhao.xu
On Thu, Aug 06, 2026 at 02:07:40PM +0800, Hongyan Xu wrote:
> ipwireless_stop_interrupts() uses timer_delete() for a timer whose callback
> can rearm itself. timer_delete() neither waits for a running callback nor
> prevents that callback from rearming the timer. The callback can therefore
> continue to access struct ipw_hardware after ipwireless_hardware_free() has
> freed it.
>
> Use timer_shutdown_sync() so teardown waits for the callback and prevents
> any further rearming.
>
> Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
> drivers/tty/ipwireless/hardware.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
> index 0bfcbca6e2df..fb3554a6e04b 100644
> --- a/drivers/tty/ipwireless/hardware.c
> +++ b/drivers/tty/ipwireless/hardware.c
> @@ -1721,7 +1721,7 @@ void ipwireless_stop_interrupts(struct ipw_hardware *hw)
> if (!hw->shutting_down) {
> /* Tell everyone we are going down. */
> hw->shutting_down = 1;
> - timer_delete(&hw->setup_timer);
> + timer_shutdown_sync(&hw->setup_timer);
>
> /* Prevent the hardware from sending any more interrupts */
> do_close_hardware(hw);
> --
> 2.50.1.windows.1
>
How was this tested?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] tty: ipwireless: shut down setup timer before freeing hardware
2026-08-06 6:07 [PATCH] tty: ipwireless: shut down setup timer before freeing hardware Hongyan Xu
2026-08-06 6:16 ` Greg Kroah-Hartman
@ 2026-08-06 7:54 ` Jiri Kosina
1 sibling, 0 replies; 3+ messages in thread
From: Jiri Kosina @ 2026-08-06 7:54 UTC (permalink / raw)
To: Hongyan Xu
Cc: David Sterba, Greg Kroah-Hartman, Jiri Slaby, Ben Martel,
Stephen Blackheath, linux-kernel, linux-serial, stable,
jianhao.xu
On Thu, 6 Aug 2026, Hongyan Xu wrote:
> ipwireless_stop_interrupts() uses timer_delete() for a timer whose callback
> can rearm itself. timer_delete() neither waits for a running callback nor
> prevents that callback from rearming the timer. The callback can therefore
> continue to access struct ipw_hardware after ipwireless_hardware_free() has
> freed it.
>
> Use timer_shutdown_sync() so teardown waits for the callback and prevents
> any further rearming.
>
> Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
> drivers/tty/ipwireless/hardware.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
> index 0bfcbca6e2df..fb3554a6e04b 100644
> --- a/drivers/tty/ipwireless/hardware.c
> +++ b/drivers/tty/ipwireless/hardware.c
> @@ -1721,7 +1721,7 @@ void ipwireless_stop_interrupts(struct ipw_hardware *hw)
> if (!hw->shutting_down) {
> /* Tell everyone we are going down. */
> hw->shutting_down = 1;
> - timer_delete(&hw->setup_timer);
> + timer_shutdown_sync(&hw->setup_timer);
>
> /* Prevent the hardware from sending any more interrupts */
> do_close_hardware(hw);
The driver is queued for removal.
--
Jiri Kosina
SUSE Labs
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-06 7:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-06 6:07 [PATCH] tty: ipwireless: shut down setup timer before freeing hardware Hongyan Xu
2026-08-06 6:16 ` Greg Kroah-Hartman
2026-08-06 7:54 ` Jiri Kosina
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox