[PATCH] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[Fan Wu]

cc_debounce_dwork lives on the system workqueue but is armed from
tcpm callbacks (set_cc/start_toggling).  Those callbacks run on tcpm's
kthread worker which is only destroyed by tcpm_unregister_port(), after
port_stop() has already returned, opening a potential race window where
tcpm's worker flush re-arms the work.

Use disable_delayed_work_sync() in port_stop() to cancel any pending
instance and prevent future schedule_delayed_work() calls from
succeeding.  Also unwind a failed port_start() through port_stop(),
which otherwise jumps straight to tcpm_unregister_port() and leaves
the same window open after a failed probe.

This issue was found by an in-house static analysis tool.

Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
Cc: stable@xxxxxxxxxxxxxxx # v6.10+
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>
---
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c      | 3 +--
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 2 ++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
index 35320f89d..f42c9e65f 100644
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
@@ -101,7 +101,7 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)
 
 	ret = tcpm->port_start(tcpm, tcpm->tcpm_port);
 	if (ret)
-		goto port_unregister;
+		goto port_stop;
 
 	ret = tcpm->pdphy_start(tcpm, tcpm->tcpm_port);
 	if (ret)
@@ -117,7 +117,6 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)
 	tcpm->pdphy_stop(tcpm);
 port_stop:
 	tcpm->port_stop(tcpm);
-port_unregister:
 	tcpm_unregister_port(tcpm->tcpm_port);
 fwnode_remove:
 	fwnode_handle_put(tcpm->tcpc.fwnode);
diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
index 429bd42a0..fdc379fc4 100644
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
@@ -694,6 +694,8 @@ static void qcom_pmic_typec_port_stop(struct pmic_typec *tcpm)
 
 	for (i = 0; i < pmic_typec_port->nr_irqs; i++)
 		disable_irq(pmic_typec_port->irq_data[i].irq);
+
+	disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
 }
 
 int qcom_pmic_typec_port_probe(struct platform_device *pdev,