[media] ts2020: cancel_delayed_work_sync before device removal / kfree

ts2020_remove  was  calling  kfree(dev)  with  possibly  still  active
schedule_delayed_work(dev->stat_work).  A similar bug in si2157 caused
kernel panics in call_timer_fn e.g. after rmmod cx23885.

Signed-off-by: Ernst Martin Witte <emw-linux-kernel@nocabal.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/dvb-frontends/ts2020.c b/drivers/media/dvb-frontends/ts2020.c
index 7979e5d6498b52a2c01f4db05a44079eeb5c3bb5..14b410ffe612c2d76381ab0177d82970384913e8 100644 (file)
--- a/drivers/media/dvb-frontends/ts2020.c
+++ b/drivers/media/dvb-frontends/ts2020.c
@@ -712,6 +712,10 @@ static int ts2020_remove(struct i2c_client *client)
 
        dev_dbg(&client->dev, "\n");
 
+       /* stop statistics polling */
+       if (!dev->dont_poll)
+               cancel_delayed_work_sync(&dev->stat_work);
+
        regmap_exit(dev->regmap);
        kfree(dev);
        return 0;