Re: [PATCH] usb: typec: altmodes/displayport: Disable work before dp is freed

[Huang Wei]

Hi Fan,

I checked this over and the race is real - typec_remove() in the typec
bus only clears adev->ops after drv->remove() has returned, and it
even calls typec_altmode_set_state(adev, TYPEC_STATE_SAFE, NULL) in
between, so dp_altmode_vdm() and friends can definitely re-queue
dp->work after the cancel_work_sync() in dp_altmode_remove(). With dp
being devm-allocated that is a use-after-free waiting to happen.

disable_work_sync() is the right fix here - it drains the work and
rejects the late schedule_work() calls, and since probe always runs
INIT_WORK on a freshly allocated dp there is no risk of the disabled
state leaking into a later bind.

Reviewed-by: Huang Wei <huangwei@xxxxxxxxxx>

Thanks,
Huang Wei