[not upstream as the driver is deleted in 4.16 - gregkh]
Whenever poll is called, the reference count is increased but never
decreased. This means that on rmmod, the lirc_thread is not stopped,
and will trample over freed memory.
Note that zilog-rx-i2c-1 should have exited by now, but hasn't due to
the missing put in poll().
This code has been replaced completely in kernel v4.16 by a new driver,
see commit acaa34bf06e9 ("media: rc: implement zilog transmitter"), and
commit f95367a7b758 ("media: staging: remove lirc_zilog driver").
Cc: stable@vger.kernel.org # v4.15- (all up to and including v4.15) Reported-by: Warren Sturm <warren.sturm@gmail.com> Tested-by: Warren Sturm <warren.sturm@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>