diff options
| author | Jiri Kosina | 2014-09-04 08:56:06 +0200 |
|---|---|---|
| committer | Jiri Kosina | 2014-09-04 08:56:06 +0200 |
| commit | 67a97845830f79584c9db8849ac723e5d2d57f65 (patch) | |
| tree | 250856471e985b57ccdc216ecd5c6f1ba9352679 /drivers/hid/hid-thingm.c | |
| parent | 8f507ef522d55a6e2f9e11a1c1163a92756da044 (diff) | |
HID: thingm: fix workqueue race on remove
thingm_remove_rgb() needs to flush the workqueue after all the LED classes
have been unregistered, otherwise the removal might race with another LED
event coming, causing thingm_led_set() to schedule additional work after
thingm_remove_rgb() has flushed it. This obviously causes oops later, as
the scheduled work has been freed in the meantime.
In addition to that, move the hid_hw_stop() to an earlier place, so that
dmesg is not polluted by failure messages about not being able to write
the LED while the device is being shut down.
Reported-and-tested-by: Dylan Alex Simon <dylan-kernel@dylex.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid/hid-thingm.c')
| -rw-r--r-- | drivers/hid/hid-thingm.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/hid/hid-thingm.c b/drivers/hid/hid-thingm.c index 134be89b15ea..f206398a5d54 100644 --- a/drivers/hid/hid-thingm.c +++ b/drivers/hid/hid-thingm.c @@ -208,10 +208,10 @@ unregister_red: static void thingm_remove_rgb(struct thingm_rgb *rgb) { - flush_work(&rgb->work); led_classdev_unregister(&rgb->red.ldev); led_classdev_unregister(&rgb->green.ldev); led_classdev_unregister(&rgb->blue.ldev); + flush_work(&rgb->work); } static int thingm_probe(struct hid_device *hdev, const struct hid_device_id *id) @@ -286,10 +286,10 @@ static void thingm_remove(struct hid_device *hdev) struct thingm_device *tdev = hid_get_drvdata(hdev); int i; + hid_hw_stop(hdev); + for (i = 0; i < tdev->fwinfo->numrgb; ++i) thingm_remove_rgb(tdev->rgb + i); - - hid_hw_stop(hdev); } static const struct hid_device_id thingm_table[] = { |