Re: [PATCH] media: rc: Fix simulated TX timer lifecycle

[Sean Young <sean@mess.org>]

On Tue, Sep 29, 2026 at 10:31:05PM +0800, Runyu Xiao wrote:
> The ENE driver only initializes tx_sim_timer when TX simulation is
> enabled for hardware without native TX support.  However, ene_remove()
> passes the timer to timer_delete_sync() unconditionally, and
> ene_tx_sample() uses the global txsim parameter when deciding whether to
> arm it.  Thus a normal device, or a device with native TX support and
> txsim enabled, can operate on an uninitialized timer.
> 
> Track whether simulation was actually enabled for each device and use
> that state for timer arming and teardown.  Since the simulation callback
> rearms the timer, shut it down permanently before freeing the device.

I think this patch is correct, but I am not sure txsim is really needed
in the source code. Maybe it's better to just remove txsim module parameter
and all the related code.


Sean

> Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  drivers/media/rc/ene_ir.c | 6 ++++--
>  drivers/media/rc/ene_ir.h | 1 +
>  2 files changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
> index 6f7dccc96..9d0279667 100644
> --- a/drivers/media/rc/ene_ir.c
> +++ b/drivers/media/rc/ene_ir.c
> @@ -652,7 +652,7 @@ static void ene_tx_sample(struct ene_device *dev)
>  	dev->tx_reg = !dev->tx_reg;
>  exit:
>  	/* simulate TX done interrupt */
> -	if (txsim)
> +	if (dev->tx_sim_enabled)
>  		mod_timer(&dev->tx_sim_timer, jiffies + HZ / 500);
>  }
>  
> @@ -1032,6 +1032,7 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
>  
>  	if (!dev->hw_learning_and_tx_capable && txsim) {
>  		dev->hw_learning_and_tx_capable = true;
> +		dev->tx_sim_enabled = true;
>  		timer_setup(&dev->tx_sim_timer, ene_tx_irqsim, 0);
>  		pr_warn("Simulation of TX activated\n");
>  	}
> @@ -1103,7 +1104,8 @@ static void ene_remove(struct pnp_dev *pnp_dev)
>  	unsigned long flags;
>  
>  	rc_unregister_device(dev->rdev);
> -	timer_delete_sync(&dev->tx_sim_timer);
> +	if (dev->tx_sim_enabled)
> +		timer_shutdown_sync(&dev->tx_sim_timer);
>  	spin_lock_irqsave(&dev->hw_lock, flags);
>  	ene_rx_disable(dev);
>  	ene_rx_restore_hw_buffer(dev);
> diff --git a/drivers/media/rc/ene_ir.h b/drivers/media/rc/ene_ir.h
> index c1c44e86e..f44cbc034 100644
> --- a/drivers/media/rc/ene_ir.h
> +++ b/drivers/media/rc/ene_ir.h
> @@ -218,6 +218,7 @@ struct ene_device {
>  	int tx_done;				/* done transmitting */
>  						/* one more sample pending*/
>  	struct completion tx_complete;		/* TX completion */
> +	bool tx_sim_enabled;			/* simulated TX is enabled */
>  	struct timer_list tx_sim_timer;
>  
>  	/* TX settings */
> -- 
> 2.34.1