Re: [PATCH v2] hwmon: (gpio-fan) fix use-after-free of alarm_work on unbind

[Guenter Roeck]

On Tue, Sep 15, 2026 at 10:54:09AM +0700, Cong Nguyen wrote:
> fan_alarm_irq_handler() schedules alarm_work, but nothing ever cancels
> it. free_irq() (via devm) only waits for an in-progress IRQ handler,
> not queued work -- a pending alarm_work can run after fan_data is
> devm-freed, dereferencing it in fan_alarm_notify().
> 
> Cancel it via a devm action registered before devm_request_irq(), so
> teardown frees the IRQ first, then cancels whatever's already queued.
> Guenter pointed out cancel_work_sync() still leaves a window if
> something schedules the work again after it's canceled; use
> disable_work_sync() instead, which permanently disables it too.
> 
> Fixes: d6fe1360f42e ("hwmon: add generic GPIO fan driver")
> Reported-by: Sashiko AI review <sashiko-bot@xxxxxxxxxx>
> Link: https://lore.kernel.org/r/20260830152150.27F5F1F000E9@xxxxxxxxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Claude:claude-opus-4
> Signed-off-by: Cong Nguyen <congnt264@xxxxxxxxx>

Turns out this was already fixed with upstream commit a2471ed17b0e ("hwmon:
(gpio-fan) Fix use-after-free in alarm work").

Guenter