[PATCH] mfd: cs42l43: cancel boot work during remove

[Hongyan Xu]

Probe queues boot_work on system_long_wq, but both transport remove
callbacks release the devm-allocated CS42L43 data without waiting for it.

Cancel the work before powering the device down. Balance the runtime-PM
reference when pending work is cancelled, and have the worker call the
power-down helper directly on error to avoid cancelling itself.

This issue was found by a static analysis tool.

Signed-off-by: Hongyan Xu <getshell@xxxxxxxxxx>
---
 drivers/mfd/cs42l43.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
index 7b6d07c..411566e 100644
--- a/drivers/mfd/cs42l43.c
+++ b/drivers/mfd/cs42l43.c
@@ -868,6 +868,8 @@ static int cs42l43_irq_config(struct cs42l43 *cs42l43)
 	return 0;
 }
 
+static int cs42l43_power_down(struct cs42l43 *cs42l43);
+
 static void cs42l43_boot_work(struct work_struct *work)
 {
 	struct cs42l43 *cs42l43 = container_of(work, struct cs42l43, boot_work);
@@ -937,7 +939,7 @@ static void cs42l43_boot_work(struct work_struct *work)
 
 err:
 	pm_runtime_put_sync(cs42l43->dev);
-	cs42l43_dev_remove(cs42l43);
+	cs42l43_power_down(cs42l43);
 }
 
 static int cs42l43_power_up(struct cs42l43 *cs42l43)
@@ -1069,6 +1071,8 @@ EXPORT_SYMBOL_NS_GPL(cs42l43_dev_probe, MFD_CS42L43);
 
 void cs42l43_dev_remove(struct cs42l43 *cs42l43)
 {
+	if (cancel_work_sync(&cs42l43->boot_work))
+		pm_runtime_put_noidle(cs42l43->dev);
 	cs42l43_power_down(cs42l43);
 }
 EXPORT_SYMBOL_NS_GPL(cs42l43_dev_remove, MFD_CS42L43);
-- 
2.50.1.windows.1