Commit f04c478d authored Nov 15, 2019 by Oliver Neukum Committed by shaohanlin Mar 05, 2020

Input: ff-memless - kill timer in destroy()



No timer must be left running when the device goes away.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-and-tested-by:  <syzbot+b6c55daa701fc389e286@syzkaller.appspotmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1573726121.17351.3.camel@suse.com


Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

parent af9cb4fb

drivers/input/ff-memless.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -501,6 +501,15 @@ static void ml_ff_destroy(struct ff_device *ff)
		{
		struct ml_device *ml = ff->private;

		/*
		* Even though we stop all playing effects when tearing down
		* an input device (via input_device_flush() that calls into
		* input_ff_flush() that stops and erases all effects), we
		* do not actually stop the timer, and therefore we should
		* do it here.
		*/
		del_timer_sync(&ml->timer);

		kfree(ml->private);
		}