As pointed out by Jonathan Corbet, the timer must be deleted before

flushing the work queue in order to avoid a job being submitted after the
chip had been released.

Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: "Serge E. Hallyn" <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 02a495c2e068cabcb119c36a5757a45ed44fbca9..1fee7034a386f4aa27cf1c5928e8e195f832c0fb 100644 (file)
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1004,9 +1004,9 @@ int tpm_release(struct inode *inode, struct file *file)
 {
        struct tpm_chip *chip = file->private_data;
 
+       del_singleshot_timer_sync(&chip->user_read_timer);
        flush_scheduled_work();
        file->private_data = NULL;
-       del_singleshot_timer_sync(&chip->user_read_timer);
        atomic_set(&chip->data_pending, 0);
        kfree(chip->data_buffer);
        clear_bit(0, &chip->is_open);