mISDN: fix race in timer canceling on module unloading

Using timer_pending() without additional syncronization is racy,
del_timer_sync() must be used here for waiting in-flight handler.
Bug caught with help from "debug-objects" during random insmod/rmmod.

Signed-off-by: Konstantin Khlebnikov <[email protected]>
Cc: Karsten Keil <[email protected]>
Cc: David S. Miller <[email protected]>
Cc: netdev <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

diff --git a/drivers/isdn/mISDN/dsp_core.c b/drivers/isdn/mISDN/dsp_core.c
index 28c99c623bcd7f89269944f788ab903f0d0c1ce0..22b720ec80cbc49b216b934045175aae3d03b2fd 100644 (file)
--- a/drivers/isdn/mISDN/dsp_core.c
+++ b/drivers/isdn/mISDN/dsp_core.c
@@ -1217,8 +1217,7 @@ static void __exit dsp_cleanup(void)
 {
        mISDN_unregister_Bprotocol(&DSP);
 
-       if (timer_pending(&dsp_spl_tl))
-               del_timer(&dsp_spl_tl);
+       del_timer_sync(&dsp_spl_tl);
 
        if (!list_empty(&dsp_ilist)) {
                printk(KERN_ERR "mISDN_dsp: Audio DSP object inst list not "