[PATCH] media: rc: Fix simulated TX timer lifecycle

[PATCH] media: rc: Fix simulated TX timer lifecycle

[Runyu Xiao]

The ENE driver only initializes tx_sim_timer when TX simulation is
enabled for hardware without native TX support.  However, ene_remove()
passes the timer to timer_delete_sync() unconditionally, and
ene_tx_sample() uses the global txsim parameter when deciding whether to
arm it.  Thus a normal device, or a device with native TX support and
txsim enabled, can operate on an uninitialized timer.

Track whether simulation was actually enabled for each device and use
that state for timer arming and teardown.  Since the simulation callback
rearms the timer, shut it down permanently before freeing the device.

Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/media/rc/ene_ir.c | 6 ++++--
 drivers/media/rc/ene_ir.h | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
index 6f7dccc96..9d0279667 100644
--- a/drivers/media/rc/ene_ir.c
+++ b/drivers/media/rc/ene_ir.c
@@ -652,7 +652,7 @@ static void ene_tx_sample(struct ene_device *dev)
 	dev->tx_reg = !dev->tx_reg;
 exit:
 	/* simulate TX done interrupt */
-	if (txsim)
+	if (dev->tx_sim_enabled)
 		mod_timer(&dev->tx_sim_timer, jiffies + HZ / 500);
 }
 
@@ -1032,6 +1032,7 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
 
 	if (!dev->hw_learning_and_tx_capable && txsim) {
 		dev->hw_learning_and_tx_capable = true;
+		dev->tx_sim_enabled = true;
 		timer_setup(&dev->tx_sim_timer, ene_tx_irqsim, 0);
 		pr_warn("Simulation of TX activated\n");
 	}
@@ -1103,7 +1104,8 @@ static void ene_remove(struct pnp_dev *pnp_dev)
 	unsigned long flags;
 
 	rc_unregister_device(dev->rdev);
-	timer_delete_sync(&dev->tx_sim_timer);
+	if (dev->tx_sim_enabled)
+		timer_shutdown_sync(&dev->tx_sim_timer);
 	spin_lock_irqsave(&dev->hw_lock, flags);
 	ene_rx_disable(dev);
 	ene_rx_restore_hw_buffer(dev);
diff --git a/drivers/media/rc/ene_ir.h b/drivers/media/rc/ene_ir.h
index c1c44e86e..f44cbc034 100644
--- a/drivers/media/rc/ene_ir.h
+++ b/drivers/media/rc/ene_ir.h
@@ -218,6 +218,7 @@ struct ene_device {
 	int tx_done;				/* done transmitting */
 						/* one more sample pending*/
 	struct completion tx_complete;		/* TX completion */
+	bool tx_sim_enabled;			/* simulated TX is enabled */
 	struct timer_list tx_sim_timer;
 
 	/* TX settings */
-- 
2.34.1

Re: [PATCH] media: rc: Fix simulated TX timer lifecycle

[Sean Young]

On Tue, Sep 29, 2026 at 10:31:05PM +0800, Runyu Xiao wrote:
> The ENE driver only initializes tx_sim_timer when TX simulation is
> enabled for hardware without native TX support.  However, ene_remove()
> passes the timer to timer_delete_sync() unconditionally, and
> ene_tx_sample() uses the global txsim parameter when deciding whether to
> arm it.  Thus a normal device, or a device with native TX support and
> txsim enabled, can operate on an uninitialized timer.
> 
> Track whether simulation was actually enabled for each device and use
> that state for timer arming and teardown.  Since the simulation callback
> rearms the timer, shut it down permanently before freeing the device.

I think this patch is correct, but I am not sure txsim is really needed
in the source code. Maybe it's better to just remove txsim module parameter
and all the related code.


Sean

> Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  drivers/media/rc/ene_ir.c | 6 ++++--
>  drivers/media/rc/ene_ir.h | 1 +
>  2 files changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
> index 6f7dccc96..9d0279667 100644
> --- a/drivers/media/rc/ene_ir.c
> +++ b/drivers/media/rc/ene_ir.c
> @@ -652,7 +652,7 @@ static void ene_tx_sample(struct ene_device *dev)
>  	dev->tx_reg = !dev->tx_reg;
>  exit:
>  	/* simulate TX done interrupt */
> -	if (txsim)
> +	if (dev->tx_sim_enabled)
>  		mod_timer(&dev->tx_sim_timer, jiffies + HZ / 500);
>  }
>  
> @@ -1032,6 +1032,7 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
>  
>  	if (!dev->hw_learning_and_tx_capable && txsim) {
>  		dev->hw_learning_and_tx_capable = true;
> +		dev->tx_sim_enabled = true;
>  		timer_setup(&dev->tx_sim_timer, ene_tx_irqsim, 0);
>  		pr_warn("Simulation of TX activated\n");
>  	}
> @@ -1103,7 +1104,8 @@ static void ene_remove(struct pnp_dev *pnp_dev)
>  	unsigned long flags;
>  
>  	rc_unregister_device(dev->rdev);
> -	timer_delete_sync(&dev->tx_sim_timer);
> +	if (dev->tx_sim_enabled)
> +		timer_shutdown_sync(&dev->tx_sim_timer);
>  	spin_lock_irqsave(&dev->hw_lock, flags);
>  	ene_rx_disable(dev);
>  	ene_rx_restore_hw_buffer(dev);
> diff --git a/drivers/media/rc/ene_ir.h b/drivers/media/rc/ene_ir.h
> index c1c44e86e..f44cbc034 100644
> --- a/drivers/media/rc/ene_ir.h
> +++ b/drivers/media/rc/ene_ir.h
> @@ -218,6 +218,7 @@ struct ene_device {
>  	int tx_done;				/* done transmitting */
>  						/* one more sample pending*/
>  	struct completion tx_complete;		/* TX completion */
> +	bool tx_sim_enabled;			/* simulated TX is enabled */
>  	struct timer_list tx_sim_timer;
>  
>  	/* TX settings */
> -- 
> 2.34.1