5e331022b4
[ Upstream commit 5000fe6c27827a61d8250a7e4a1d26c3298ef4f6 ]
This bug influences both st_nci_i2c_remove and st_nci_spi_remove.
Take st_nci_i2c_remove as an example.
In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work
with llt_ndlc_sm_work.
When it calls ndlc_recv or timeout handler, it will finally call
schedule_work to start the work.
When we call st_nci_i2c_remove to remove the driver, there
may be a sequence as follows:
Fix it by finishing the work before cleanup in ndlc_remove
CPU0 CPU1
|llt_ndlc_sm_work
st_nci_i2c_remove |
ndlc_remove |
st_nci_remove |
nci_free_device|
kfree(ndev) |
//free ndlc->ndev |
|llt_ndlc_rcv_queue
|nci_recv_frame
|//use ndlc->ndev
Fixes:
|
||
|---|---|---|
| .. | ||
| fdp | ||
| microread | ||
| nfcmrvl | ||
| nxp-nci | ||
| pn533 | ||
| pn544 | ||
| s3fwrn5 | ||
| st-nci | ||
| st21nfca | ||
| st95hf | ||
| Kconfig | ||
| Makefile | ||
| mei_phy.c | ||
| mei_phy.h | ||
| nfcsim.c | ||
| port100.c | ||
| trf7970a.c | ||
| virtual_ncidev.c | ||