Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 71795c1d authored by Pete Zaitcev's avatar Pete Zaitcev Committed by Greg Kroah-Hartman
Browse files

USB: ohci_usb can oops on shutdown 



When ohci-hcd is shutting down (for rmmod or PC-card removal), there is
a window when the device is shut down, HC communication area (->hcca)
is freed, but the core has not called "free_irq" yet. If another device
triggers a shared interrupt in this window, we oops when trying to
access the freed ->hcca.

This patch removes the window by calling free_irq before ->hcca is freed.

The patch is tested at the PC hotplug test rig at Stratus, and with
rmmod by Rafael Wysocki.

Signed-off-by: default avatarPete Zaitcev <zaitcev@redhat.com>
Signed-off-by: default avatarDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 38e2bfc9

drivers/usb/host/ohci-hcd.c

+3 −1
Original line number Diff line number Diff line
@@ -795,6 +795,8 @@ static void ohci_stop (struct usb_hcd *hcd) 


	ohci_usb_reset (ohci);

	ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);

	free_irq(hcd->irq, hcd);

	hcd->irq = -1;



	remove_debug_files (ohci);

	ohci_mem_cleanup (ohci);