USB: ohci_usb can oops on shutdown
When ohci-hcd is shutting down (for rmmod or PC-card removal), there is a window when the device is shut down, HC communication area (->hcca) is freed, but the core has not called "free_irq" yet. If another device triggers a shared interrupt in this window, we oops when trying to access the freed ->hcca. This patch removes the window by calling free_irq before ->hcca is freed. The patch is tested at the PC hotplug test rig at Stratus, and with rmmod by Rafael Wysocki. Signed-off-by: Pete Zaitcev <zaitcev@redhat.com> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
parent
38e2bfc94e
commit
71795c1df3
1 changed files with 3 additions and 1 deletions
|
@ -795,6 +795,8 @@ static void ohci_stop (struct usb_hcd *hcd)
|
||||||
|
|
||||||
ohci_usb_reset (ohci);
|
ohci_usb_reset (ohci);
|
||||||
ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
|
ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
|
||||||
|
free_irq(hcd->irq, hcd);
|
||||||
|
hcd->irq = -1;
|
||||||
|
|
||||||
remove_debug_files (ohci);
|
remove_debug_files (ohci);
|
||||||
ohci_mem_cleanup (ohci);
|
ohci_mem_cleanup (ohci);
|
||||||
|
|
Reference in a new issue