From 71795c1df30b034414c921b4930ed88de34ca348 Mon Sep 17 00:00:00 2001
From: Pete Zaitcev <zaitcev@redhat.com>
Date: Mon, 18 Sep 2006 22:57:22 -0700
Subject: USB: ohci_usb can oops on shutdown

When ohci-hcd is shutting down (for rmmod or PC-card removal), there is
a window when the device is shut down, HC communication area (->hcca)
is freed, but the core has not called "free_irq" yet. If another device
triggers a shared interrupt in this window, we oops when trying to
access the freed ->hcca.

This patch removes the window by calling free_irq before ->hcca is freed.

The patch is tested at the PC hotplug test rig at Stratus, and with
rmmod by Rafael Wysocki.

Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/host/ohci-hcd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 2c614af8f733..1027aa04583d 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -795,7 +795,9 @@ static void ohci_stop (struct usb_hcd *hcd)
 
 	ohci_usb_reset (ohci);
 	ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);
-	
+	free_irq(hcd->irq, hcd);
+	hcd->irq = -1;
+
 	remove_debug_files (ohci);
 	ohci_mem_cleanup (ohci);
 	if (ohci->hcca) {
-- 
cgit v1.2.3