On Tue, Feb 10, 2015 at 10:41:56AM +0000, Sifan Naeem wrote:
> img_ir_remove() passes a pointer to the ISR function as the 2nd
> parameter to irq_free() instead of a pointer to the device data
> structure.
> This issue causes unloading img-ir module to fail with the below
> warning after building and loading img-ir as a module.
>
> WARNING: CPU: 2 PID: 155 at ../kernel/irq/manage.c:1278
> __free_irq+0xb4/0x214() Trying to free already-free IRQ 58
> Modules linked in: img_ir(-)
> CPU: 2 PID: 155 Comm: rmmod Not tainted 3.14.0 #55 ...
> Call Trace:
> ...
> [<8048d420>] __free_irq+0xb4/0x214
> [<8048d6b4>] free_irq+0xac/0xf4
> [<c009b130>] img_ir_remove+0x54/0xd4 [img_ir] [<8073ded0>]
> platform_drv_remove+0x30/0x54 ...
>
> Signed-off-by: Sifan Naeem <sifan.naeem@xxxxxxxxxx>
> Fixes: 160a8f8aec4d ("[media] rc: img-ir: add base driver")
> Cc: <stable@xxxxxxxxxxxxxxx> # 3.15+
Thanks for catching this Sifan. It appears to have been introduced while
getting the driver ready for upstream (it used to use the devm_* API to
request the IRQ, but I changed it to avoid the ISR racing with module
removal).
Acked-by: James Hogan <james.hogan@xxxxxxxxxx>
Cheers
James
> ---
> drivers/media/rc/img-ir/img-ir-core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/rc/img-ir/img-ir-core.c b/drivers/media/rc/img-ir/img-ir-core.c
> index 77c78de..7020659 100644
> --- a/drivers/media/rc/img-ir/img-ir-core.c
> +++ b/drivers/media/rc/img-ir/img-ir-core.c
> @@ -146,7 +146,7 @@ static int img_ir_remove(struct platform_device *pdev)
> {
> struct img_ir_priv *priv = platform_get_drvdata(pdev);
>
> - free_irq(priv->irq, img_ir_isr);
> + free_irq(priv->irq, priv);
> img_ir_remove_hw(priv);
> img_ir_remove_raw(priv);
>
> --
> 1.7.9.5
>
Attachment:
signature.asc
Description: Digital signature
