From: Kirill Tkhai <tkhai@yandex.ru>
Date: Mon, 10 Feb 2014 18:40:11 +0000 (+0400)
Subject: staging: sbe-2t3e3: Fix possible reuse of freed memory in timer function
X-Git-Tag: v4.0~2156^2~1172
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=81291dd9484dd16e795ab4a69d16b401b2aa5821;p=platform%2Fkernel%2Flinux-amlogic.git

staging: sbe-2t3e3: Fix possible reuse of freed memory in timer function

Do not call kfree() till timer function is finished.

[This was found using grep. Compilation tested only]

Signed-off-by: Kirill Tkhai <tkhai@yandex.ru>
CC: Joe Perches <joe@perches.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/sbe-2t3e3/module.c b/drivers/staging/sbe-2t3e3/module.c
index 0e32be5..a6f93a43 100644
--- a/drivers/staging/sbe-2t3e3/module.c
+++ b/drivers/staging/sbe-2t3e3/module.c
@@ -122,7 +122,7 @@ static void t3e3_remove_card(struct pci_dev *pdev)
 	struct channel *channel0 = pci_get_drvdata(pdev);
 	struct card *card = channel0->card;
 
-	del_timer(&card->timer);
+	del_timer_sync(&card->timer);
 	if (has_two_ports(channel0->pdev)) {
 		t3e3_remove_channel(&card->channels[1]);
 		pci_dev_put(card->channels[1].pdev);