Re: [PATCH v8 01/14] drm/bridge: it6505: quiesce event sources and work on remove()

[Luca Ceresoli]

> struct it6505 is freed by devres right after remove() returns, but
> remove() cancels none of the driver's work items, so link_works,
> hdcp_wait_ksv_list, hdcp_work and extcon_wq can still run afterwards
> and dereference freed memory. Cancelling alone would not be enough:
> the threaded IRQ and the extcon notifier stay live until devres
> teardown and can requeue the works.
>
> Unregister the extcon notifier and disable the IRQ first, then cancel
> all work. Make it6505_remove_notifier_module() idempotent, tracking
> the registration in a flag under extcon_lock, as both .detach() and
> remove() call it now. The notifier_call pointer is left intact:
> extcon traverses its raw notifier chain without holding a lock, so a
> traversal racing with the unregistration may still invoke the
> callback. Also initialise extcon_wq in probe: cancel_work_sync() on a
> never-initialised work item trips WARN_ON(!work->func).
>
> Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
> Signed-off-by: Daniel Golle <daniel@xxxxxxxxxxxxxx>

Looks good:

Reviewed-by: Luca Ceresoli <luca.ceresoli@xxxxxxxxxxx>

-- 
Luca Ceresoli, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com