From 2bd05ff8f8a4d0276b0c7b3aadd848774ac54473 Mon Sep 17 00:00:00 2001 From: Hongyan Xu Date: Tue, 28 Jul 2026 16:55:54 +0800 Subject: [PATCH] atm: idt77252: shut down tst timer on probe failure init_card() calls fill_tst(), which arms tst_timer to switch the transmit schedule table. If the subsequent idt77252_dev_open() call fails, probe tears down the card and frees its memory while the timer may still be pending or running. Shut down the timer synchronously before deinitializing the card so the callback cannot access released card resources or be rearmed during teardown. The timer is initialized before every path to this error label, so shutting it down is also safe for earlier probe failures. This issue was found by a static analysis tool. Signed-off-by: Hongyan Xu --- drivers/atm/idt77252.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c index 7f8aaf5..f4a73f4 100644 --- a/drivers/atm/idt77252.c +++ b/drivers/atm/idt77252.c @@ -3722,6 +3722,7 @@ static int idt77252_init_one(struct pci_dev *pcidev, dev->phy->stop(dev); err_out_deinit_card: + timer_shutdown_sync(&card->tst_timer); deinit_card(card); err_out_iounmap: