- Kernel - mailweb.openeuler.org

openEuler Kernel SIG 双周例会
by openEuler conference 28 Jun '23

28 Jun '23

您好！ Kernel SIG 邀请您参加 2023-06-30 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG 双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/81270448575?pwd=WElDeFQ1azluejNHcXR0a3Y4R1VHUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-06-30 14:00, The subject of the conference is openEuler Kernel SIG 双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/81270448575?pwd=WElDeFQ1azluejNHcXR0a3Y4R1VHUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH OLK-5.10] usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
by Jialin Zhang 28 Jun '23

28 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.4-rc1 commit 2b947f8769be8b8181dc795fd292d3e7120f5204 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7EDYS CVE: CVE-2023-35828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. renesas_usb3_start will be called to start the work. If we remove the driver which will call usbhs_remove, there may be an unfinished work. The possible sequence is as follows: CPU0 CPU1 renesas_usb3_role_work renesas_usb3_remove usb_role_switch_unregister device_unregister kfree(sw) //free usb3->role_sw usb_role_switch_set_role //use usb3->role_sw The usb3->role_sw could be freed under such circumstance and then used in usb_role_switch_set_role. This bug was found by static analysis. And note that removing a driver is a root-only operation, and should never happen in normal case. But the root user may directly remove the device which will also trigger the remove function. Fix it by canceling the work before cleanup in the renesas_usb3_remove. Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/usb/gadget/udc/renesas_usb3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c index 601829a6b4ba..a10f41c4a3f2 100644 --- a/drivers/usb/gadget/udc/renesas_usb3.c +++ b/drivers/usb/gadget/udc/renesas_usb3.c @@ -2568,6 +2568,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) debugfs_remove_recursive(usb3->dentry); device_remove_file(&pdev->dev, &dev_attr_role); + cancel_work_sync(&usb3->role_work); usb_role_switch_unregister(usb3->role_sw); usb_del_gadget_udc(&usb3->gadget); -- 2.25.1

2 1

[PATCH OLK-5.10] ethtool: Fix link extended state for big endian
by Zhengchao Shao 28 Jun '23

28 Jun '23

From: Moshe Tal <moshet(a)nvidia.com> mainline inclusion from mainline-v5.17-rc2 commit e2f08207c558bc0bc8abaa557cdb29bad776ac7b category: feature bugzilla: 188943 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The link extended sub-states are assigned as enum that is an integer size but read from a union as u8, this is working for small values on little endian systems but for big endian this always give 0. Fix the variable in the union to match the enum size. Fixes: ecc31c60240b ("ethtool: Add link extended state") Signed-off-by: Moshe Tal <moshet(a)nvidia.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Tested-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Gal Pressman <gal(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: include/linux/ethtool.h Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/linux/ethtool.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index 726c1b27f3c4..cdfb3cc0951d 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -112,7 +112,7 @@ struct ethtool_link_ext_state_info { enum ethtool_link_ext_substate_link_logical_mismatch link_logical_mismatch; enum ethtool_link_ext_substate_bad_signal_integrity bad_signal_integrity; enum ethtool_link_ext_substate_cable_issue cable_issue; - u8 __link_ext_substate; + u32 __link_ext_substate; }; }; -- 2.34.1

2 1

[PATCH OLK-5.10,v2] ethtool: Fix link extended state for big endian
by Zhengchao Shao 28 Jun '23

28 Jun '23

From: Moshe Tal <moshet(a)nvidia.com> mainline inclusion from mainline-v5.17-rc2 commit e2f08207c558bc0bc8abaa557cdb29bad776ac7b category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7GNV3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The link extended sub-states are assigned as enum that is an integer size but read from a union as u8, this is working for small values on little endian systems but for big endian this always give 0. Fix the variable in the union to match the enum size. Fixes: ecc31c60240b ("ethtool: Add link extended state") Signed-off-by: Moshe Tal <moshet(a)nvidia.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Tested-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Gal Pressman <gal(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: include/linux/ethtool.h Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- v2: modify comment --- include/linux/ethtool.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index 726c1b27f3c4..cdfb3cc0951d 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -112,7 +112,7 @@ struct ethtool_link_ext_state_info { enum ethtool_link_ext_substate_link_logical_mismatch link_logical_mismatch; enum ethtool_link_ext_substate_bad_signal_integrity bad_signal_integrity; enum ethtool_link_ext_substate_cable_issue cable_issue; - u8 __link_ext_substate; + u32 __link_ext_substate; }; }; -- 2.34.1

1 0

[PATCH OLK-5.10 0/2] Two CVE fixes of ksmbd
by ZhaoLong Wang 28 Jun '23

28 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 *** BLURB HERE *** Namjae Jeon (2): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() fs/ksmbd/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+) -- 2.31.1

2 3

[PATCH 0/2] Two CVE fixes of ksmbd
by ZhaoLong Wang 27 Jun '23

27 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 *** BLURB HERE *** Namjae Jeon (2): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() fs/ksmbd/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+) -- 2.31.1

1 2

[PATCH] Add hugetlb_optimize_vmemmap_key and __x86_return_thunk to kabi whitelist
by Jialin Zhang 27 Jun '23

27 Jun '23

bugzilla: https://gitee.com/openeuler/kernel/issues/I7GJJY Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- Module.kabi_aarch64 | 1 + Module.kabi_x86_64 | 2 ++ kabi_whitelist_aarch64 | 1 + kabi_whitelist_x86_64 | 2 ++ kernel.spec | 5 ++++- 5 files changed, 10 insertions(+), 1 deletion(-) diff --git a/Module.kabi_aarch64 b/Module.kabi_aarch64 index 104b60e..5aa0dd1 100644 --- a/Module.kabi_aarch64 +++ b/Module.kabi_aarch64 @@ -1111,6 +1111,7 @@ 0x21713595 hrtimer_init vmlinux EXPORT_SYMBOL_GPL 0x8dd504f3 hrtimer_start_range_ns vmlinux EXPORT_SYMBOL_GPL 0xa452f5f1 hrtimer_try_to_cancel vmlinux EXPORT_SYMBOL_GPL +0xbcb36fe4 hugetlb_optimize_vmemmap_key vmlinux EXPORT_SYMBOL 0xdda8dc9c __hw_addr_sync_dev vmlinux EXPORT_SYMBOL 0xc5d47b9a __hw_addr_unsync_dev vmlinux EXPORT_SYMBOL 0xea6847b6 hwmon_device_register vmlinux EXPORT_SYMBOL_GPL diff --git a/Module.kabi_x86_64 b/Module.kabi_x86_64 index 9c3ef26..5159a19 100644 --- a/Module.kabi_x86_64 +++ b/Module.kabi_x86_64 @@ -1236,6 +1236,7 @@ 0x21713595 hrtimer_init vmlinux EXPORT_SYMBOL_GPL 0x8dd504f3 hrtimer_start_range_ns vmlinux EXPORT_SYMBOL_GPL 0xa452f5f1 hrtimer_try_to_cancel vmlinux EXPORT_SYMBOL_GPL +0xbcb36fe4 hugetlb_optimize_vmemmap_key vmlinux EXPORT_SYMBOL 0xf689728b __hw_addr_sync_dev vmlinux EXPORT_SYMBOL 0x8b743647 __hw_addr_unsync_dev vmlinux EXPORT_SYMBOL 0xa3633bba hwmon_device_register vmlinux EXPORT_SYMBOL_GPL @@ -3108,6 +3109,7 @@ 0xd979a547 __x86_indirect_thunk_rdi vmlinux EXPORT_SYMBOL 0xb601be4c __x86_indirect_thunk_rdx vmlinux EXPORT_SYMBOL 0xa1f9a134 __x86_indirect_thunk_rsi vmlinux EXPORT_SYMBOL +0x5b8239ca __x86_return_thunk vmlinux EXPORT_SYMBOL 0x9114b616 __xa_alloc vmlinux EXPORT_SYMBOL 0xb04a43ad __xa_alloc_cyclic vmlinux EXPORT_SYMBOL 0x0a0ebc08 __xa_cmpxchg vmlinux EXPORT_SYMBOL diff --git a/kabi_whitelist_aarch64 b/kabi_whitelist_aarch64 index 58c9450..3ee346e 100644 --- a/kabi_whitelist_aarch64 +++ b/kabi_whitelist_aarch64 @@ -1112,6 +1112,7 @@ hrtimer_init hrtimer_start_range_ns hrtimer_try_to_cancel + hugetlb_optimize_vmemmap_key __hw_addr_sync_dev __hw_addr_unsync_dev hwmon_device_register diff --git a/kabi_whitelist_x86_64 b/kabi_whitelist_x86_64 index 4724b46..4cf5de1 100644 --- a/kabi_whitelist_x86_64 +++ b/kabi_whitelist_x86_64 @@ -1237,6 +1237,7 @@ hrtimer_init hrtimer_start_range_ns hrtimer_try_to_cancel + hugetlb_optimize_vmemmap_key __hw_addr_sync_dev __hw_addr_unsync_dev hwmon_device_register @@ -3109,6 +3110,7 @@ __x86_indirect_thunk_rdi __x86_indirect_thunk_rdx __x86_indirect_thunk_rsi + __x86_return_thunk __xa_alloc __xa_alloc_cyclic __xa_cmpxchg diff --git a/kernel.spec b/kernel.spec index 9ca5de2..8929234 100644 --- a/kernel.spec +++ b/kernel.spec @@ -12,7 +12,7 @@ %global upstream_sublevel 0 %global devel_release 153 %global maintenance_release .12.0 -%global pkg_release .89 +%global pkg_release .90 %define with_debuginfo 1 # Do not recompute the build-id of vmlinux in find-debuginfo.sh @@ -910,6 +910,9 @@ fi %endif %changelog +* Tue Jun 27 2023 Jialin Zhang <zhangjialin11(a)huawei.com> - 5.10.0-153.12.0.90 +- Add hugetlb_optimize_vmemmap_key and __x86_return_thunk to kabi whitelist + * Sun Jun 25 2023 Zheng Zengkai <zhengzengkai(a)huawei.com> - 5.10.0-153.12.0.89 - !1189 [sync] PR-1177: net/sched: flower: fix possible OOB write in fl_set_geneve_opt() - !1226 [sync] PR-1221: media: rkvdec: fix use after free bug in rkvdec_remove -- 2.25.1

1 0

[PATCH OLK-5.10] media: saa7134: fix use after free bug in saa7134_finidev due to race condition
by Longlong Xia 27 Jun '23

27 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v5.10.180 commit 7dac96e9cc985328ec1fae92f0c245f559dc0e11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7ERIV CVE: CVE-2023-3327 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ] In saa7134_initdev, it will call saa7134_hwinit1. There are three function invoking here: saa7134_video_init1, saa7134_ts_init1 and saa7134_vbi_init1. All of them will init a timer with same function. Take saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout with saa7134_buffer_timeout. In buffer_activate, the timer funtcion is started. If we remove the module or device which will call saa7134_finidev to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the timer works accordingly before cleanup in saa7134_finidev. CPU0 CPU1 |saa7134_buffer_timeout saa7134_finidev | kfree(dev); | | | saa7134_buffer_next | //use dev Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> --- drivers/media/pci/saa7134/saa7134-ts.c | 1 + drivers/media/pci/saa7134/saa7134-vbi.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 1 + 3 files changed, 3 insertions(+) diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c index 6a5053126237..437dbe5e75e2 100644 --- a/drivers/media/pci/saa7134/saa7134-ts.c +++ b/drivers/media/pci/saa7134/saa7134-ts.c @@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev) int saa7134_ts_fini(struct saa7134_dev *dev) { + del_timer_sync(&dev->ts_q.timeout); saa7134_pgtable_free(dev->pci, &dev->ts_q.pt); return 0; } diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c index 3f0b0933eed6..3e773690468b 100644 --- a/drivers/media/pci/saa7134/saa7134-vbi.c +++ b/drivers/media/pci/saa7134/saa7134-vbi.c @@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev) int saa7134_vbi_fini(struct saa7134_dev *dev) { /* nothing */ + del_timer_sync(&dev->vbi_q.timeout); return 0; } diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c index 85d082baaadc..df9e3293015a 100644 --- a/drivers/media/pci/saa7134/saa7134-video.c +++ b/drivers/media/pci/saa7134/saa7134-video.c @@ -2153,6 +2153,7 @@ int saa7134_video_init1(struct saa7134_dev *dev) void saa7134_video_fini(struct saa7134_dev *dev) { + del_timer_sync(&dev->video_q.timeout); /* free stuff */ saa7134_pgtable_free(dev->pci, &dev->video_q.pt); saa7134_pgtable_free(dev->pci, &dev->vbi_q.pt); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] HID: intel_ish-hid: Add check for ishtp_dma_tx_map
by Yongqiang Liu 27 Jun '23

27 Jun '23

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v4.19.272 commit cc906a3a4432da143ab3d2e894f99ddeff500cd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7FCLX CVE: CVE-2023-3358 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8 ] As the kcalloc may return NULL pointer, it should be better to check the ishtp_dma_tx_map before use in order to avoid NULL pointer dereference. Fixes: 3703f53b99e4 ("HID: intel_ish-hid: ISH Transport layer") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: GUO Zihua<guozihua(a)huawei.com> Reviewed-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hid/intel-ish-hid/ishtp/dma-if.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/hid/intel-ish-hid/ishtp/dma-if.c b/drivers/hid/intel-ish-hid/ishtp/dma-if.c index 2783f3666114..ff4419c8ed4f 100644 --- a/drivers/hid/intel-ish-hid/ishtp/dma-if.c +++ b/drivers/hid/intel-ish-hid/ishtp/dma-if.c @@ -113,6 +113,11 @@ void *ishtp_cl_get_dma_send_buf(struct ishtp_device *dev, int required_slots = (size / DMA_SLOT_SIZE) + 1 * (size % DMA_SLOT_SIZE != 0); + if (!dev->ishtp_dma_tx_map) { + dev_err(dev->devc, "Fail to allocate Tx map\n"); + return NULL; + } + spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags); for (i = 0; i <= (dev->ishtp_dma_num_slots - required_slots); i++) { free = 1; @@ -159,6 +164,11 @@ void ishtp_cl_release_dma_acked_mem(struct ishtp_device *dev, return; } + if (!dev->ishtp_dma_tx_map) { + dev_err(dev->devc, "Fail to allocate Tx map\n"); + return; + } + i = (msg_addr - dev->ishtp_host_dma_tx_buf) / DMA_SLOT_SIZE; spin_lock_irqsave(&dev->ishtp_dma_tx_lock, flags); for (j = 0; j < acked_slots; j++) { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] media: saa7134: fix use after free bug in saa7134_finidev due to race condition
by Yongqiang Liu 27 Jun '23

27 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v4.19.283 commit 95e684340470a95ff4957cb9a536ec7a0461c75b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7ERIV CVE: CVE-2023-3327 -------------------------------- [ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ] In saa7134_initdev, it will call saa7134_hwinit1. There are three function invoking here: saa7134_video_init1, saa7134_ts_init1 and saa7134_vbi_init1. All of them will init a timer with same function. Take saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout with saa7134_buffer_timeout. In buffer_activate, the timer funtcion is started. If we remove the module or device which will call saa7134_finidev to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the timer works accordingly before cleanup in saa7134_finidev. CPU0 CPU1 |saa7134_buffer_timeout saa7134_finidev | kfree(dev); | | | saa7134_buffer_next | //use dev Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/media/pci/saa7134/saa7134-ts.c | 1 + drivers/media/pci/saa7134/saa7134-vbi.c | 1 + drivers/media/pci/saa7134/saa7134-video.c | 1 + 3 files changed, 3 insertions(+) diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c index 2be703617e29..e7adcd4f9962 100644 --- a/drivers/media/pci/saa7134/saa7134-ts.c +++ b/drivers/media/pci/saa7134/saa7134-ts.c @@ -309,6 +309,7 @@ int saa7134_ts_start(struct saa7134_dev *dev) int saa7134_ts_fini(struct saa7134_dev *dev) { + del_timer_sync(&dev->ts_q.timeout); saa7134_pgtable_free(dev->pci, &dev->ts_q.pt); return 0; } diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c index 57bea543c39b..559db500b19c 100644 --- a/drivers/media/pci/saa7134/saa7134-vbi.c +++ b/drivers/media/pci/saa7134/saa7134-vbi.c @@ -194,6 +194,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev) int saa7134_vbi_fini(struct saa7134_dev *dev) { /* nothing */ + del_timer_sync(&dev->vbi_q.timeout); return 0; } diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c index 1a50ec9d084f..103cbc8c1345 100644 --- a/drivers/media/pci/saa7134/saa7134-video.c +++ b/drivers/media/pci/saa7134/saa7134-video.c @@ -2213,6 +2213,7 @@ int saa7134_video_init1(struct saa7134_dev *dev) void saa7134_video_fini(struct saa7134_dev *dev) { + del_timer_sync(&dev->video_q.timeout); /* free stuff */ vb2_queue_release(&dev->video_vbq); saa7134_pgtable_free(dev->pci, &dev->video_q.pt); -- 2.25.1

1 0