From: Julia Lawall <Julia.Lawall@xxxxxxx> The data referenced by an interrupt handler should not be freed before the interrupt is ended. The handler is pxa_camera_irq. This handler may call pxa_dma_start_channels, which references the channels that are freed on the lines before the call to free_irq. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @fn exists@ expression list es; expression a,b; identifier f; @@ if (...) { ... when any free_irq(a,b); ... when any f(es); ... when any return ...; } @@ expression list fn.es; expression fn.a,fn.b; identifier fn.f; @@ *f(es); ... when any *free_irq(a,b); // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@xxxxxxx> --- Not compiled. I have not observed the problem in practice; the code just looks suspicious. drivers/media/platform/soc_camera/pxa_camera.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/soc_camera/pxa_camera.c b/drivers/media/platform/soc_camera/pxa_camera.c index f91f7bf..2a19aba 100644 --- a/drivers/media/platform/soc_camera/pxa_camera.c +++ b/drivers/media/platform/soc_camera/pxa_camera.c @@ -1810,10 +1810,10 @@ static int pxa_camera_remove(struct platform_device *pdev) clk_put(pcdev->clk); + free_irq(pcdev->irq, pcdev); pxa_free_dma(pcdev->dma_chans[0]); pxa_free_dma(pcdev->dma_chans[1]); pxa_free_dma(pcdev->dma_chans[2]); - free_irq(pcdev->irq, pcdev); soc_camera_host_unregister(soc_host); -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
