mirror of
https://github.com/torvalds/linux.git
synced 2025-04-09 14:45:27 +00:00
0668e8ccd3
del_timer() does not wait until the timer handler finishing. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix it by calling del_timer_sync(), which makes sure the timer handler has finished. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Dipen Patel <dipenp@nvidia.com> Acked-by: Dipen Patel <dipenp@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>