* [PATCH] Input: hp_sdc: shut down kicker timer on module exit
@ 2026-09-02 15:40 Runyu Xiao
2026-09-12 20:53 ` Helge Deller
2026-09-14 1:23 ` Dmitry Torokhov
0 siblings, 2 replies; 3+ messages in thread
From: Runyu Xiao @ 2026-09-02 15:40 UTC (permalink / raw)
To: James E . J . Bottomley
Cc: Helge Deller, Dmitry Torokhov, linux-parisc, linux-input,
linux-kernel, stable, Runyu Xiao, Jianhao Xu
hp_sdc_kicker() rearms hp_sdc.kicker with mod_timer() after scheduling the
tasklet. The module exit path uses timer_delete_sync(). That waits for a
callback already running but can still leave the timer rearmed.
A callback can therefore leave the timer pending while hp_sdc_exit() tears
down the driver, allowing timer activity to access dismantled driver state.
Use timer_shutdown_sync() for final teardown. It waits for a running
callback and prevents rearming after module exit begins.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
drivers/input/serio/hp_sdc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index 1461ef319..ecf5347b6 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -981,7 +981,7 @@ static void hp_sdc_exit(void)
free_irq(hp_sdc.irq, &hp_sdc);
write_unlock_irq(&hp_sdc.lock);
- timer_delete_sync(&hp_sdc.kicker);
+ timer_shutdown_sync(&hp_sdc.kicker);
tasklet_kill(&hp_sdc.task);
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] Input: hp_sdc: shut down kicker timer on module exit
2026-09-02 15:40 [PATCH] Input: hp_sdc: shut down kicker timer on module exit Runyu Xiao
@ 2026-09-12 20:53 ` Helge Deller
2026-09-14 1:23 ` Dmitry Torokhov
1 sibling, 0 replies; 3+ messages in thread
From: Helge Deller @ 2026-09-12 20:53 UTC (permalink / raw)
To: Runyu Xiao, linux-input
Cc: Dmitry Torokhov, linux-parisc, linux-kernel, Jianhao Xu
On 9/2/26 17:40, Runyu Xiao wrote:
> hp_sdc_kicker() rearms hp_sdc.kicker with mod_timer() after scheduling the
> tasklet. The module exit path uses timer_delete_sync(). That waits for a
> callback already running but can still leave the timer rearmed.
>
> A callback can therefore leave the timer pending while hp_sdc_exit() tears
> down the driver, allowing timer activity to access dismantled driver state.
>
> Use timer_shutdown_sync() for final teardown. It waits for a running
> callback and prevents rearming after module exit begins.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Acked-by: Helge Deller <deller@gmx.de>
Helge
> ---
> drivers/input/serio/hp_sdc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
> index 1461ef319..ecf5347b6 100644
> --- a/drivers/input/serio/hp_sdc.c
> +++ b/drivers/input/serio/hp_sdc.c
> @@ -981,7 +981,7 @@ static void hp_sdc_exit(void)
> free_irq(hp_sdc.irq, &hp_sdc);
> write_unlock_irq(&hp_sdc.lock);
>
> - timer_delete_sync(&hp_sdc.kicker);
> + timer_shutdown_sync(&hp_sdc.kicker);
>
> tasklet_kill(&hp_sdc.task);
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] Input: hp_sdc: shut down kicker timer on module exit
2026-09-02 15:40 [PATCH] Input: hp_sdc: shut down kicker timer on module exit Runyu Xiao
2026-09-12 20:53 ` Helge Deller
@ 2026-09-14 1:23 ` Dmitry Torokhov
1 sibling, 0 replies; 3+ messages in thread
From: Dmitry Torokhov @ 2026-09-14 1:23 UTC (permalink / raw)
To: Runyu Xiao
Cc: James E . J . Bottomley, Helge Deller, linux-parisc, linux-input,
linux-kernel, stable, Jianhao Xu
On Wed, Sep 02, 2026 at 11:40:04PM +0800, Runyu Xiao wrote:
> hp_sdc_kicker() rearms hp_sdc.kicker with mod_timer() after scheduling the
> tasklet. The module exit path uses timer_delete_sync(). That waits for a
> callback already running but can still leave the timer rearmed.
>
> A callback can therefore leave the timer pending while hp_sdc_exit() tears
> down the driver, allowing timer activity to access dismantled driver state.
>
> Use timer_shutdown_sync() for final teardown. It waits for a running
> callback and prevents rearming after module exit begins.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Applied, thank you.
--
Dmitry
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-14 1:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-02 15:40 [PATCH] Input: hp_sdc: shut down kicker timer on module exit Runyu Xiao
2026-09-12 20:53 ` Helge Deller
2026-09-14 1:23 ` Dmitry Torokhov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®