[PATCH] media: saa7164: cancel workcmd after disabling IRQ in saa7164_finidev

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

saa7164_finidev() does not cancel the workcmd work item that the IRQ
handler schedules via schedule_work() for command responses.  If the
work is still pending when the device structure is freed, the work
callback runs on stale memory.

Add cancel_work_sync() for workcmd after free_irq() so the interrupt
source is fully stopped before draining the remaining work.

Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/media/pci/saa7164/saa7164-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index ac5eb6b923e21..8c6dd8dfd9a1e 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -1518,6 +1518,8 @@ static void saa7164_finidev(struct pci_dev *pci_dev)
 	/* unregister stuff */
 	free_irq(pci_dev->irq, dev);
 
+	cancel_work_sync(&dev->workcmd);
+
 	if (dev->msi) {
 		pci_disable_msi(pci_dev);
 		dev->msi = false;
-- 
2.47.3