[PATCH] usb: host: fhci: drain completion tasklet during removal

[Jiale Yao]

The transfer confirmation path can queue process_done_task immediately
before the timer IRQ is freed.  free_irq() prevents new hard IRQ
handlers, but it does not drain a tasklet that was already queued.  The
tasklet can therefore access the FHCI schedule, timer, and HCD after the
remove path releases them.

Kill the tasklet after freeing the timer IRQ and before releasing the
resources it accesses.

Fixes: 236dd4d18f29 ("USB: Driver for Freescale QUICC Engine USB Host Controller")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/usb/host/fhci-hcd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/host/fhci-hcd.c b/drivers/usb/host/fhci-hcd.c
index d572f0c1dffa..c3fd7f77a71f 100644
--- a/drivers/usb/host/fhci-hcd.c
+++ b/drivers/usb/host/fhci-hcd.c
@@ -757,6 +757,7 @@ static void fhci_remove(struct device *dev)
 
 	usb_remove_hcd(hcd);
 	free_irq(fhci->timer->irq, hcd);
+	tasklet_kill(fhci->process_done_task);
 	gtm_put_timer16(fhci->timer);
 	cpm_muram_free(cpm_muram_offset(fhci->pram));
 	for (j = 0; j < NUM_PINS; j++)
-- 
2.34.1