Re: [PATCH v2 1/2] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[Heikki Krogerus]

On Thu, Aug 20, 2026 at 01:53:06PM +0000, Fan Wu wrote:
> cc_debounce_dwork is queued from the set_cc() and start_toggling()
> callbacks, which run from TCPM's kthread worker.  port_stop() returns
> before tcpm_unregister_port() destroys that worker.  Flushing the worker
> during unregister may therefore run a callback which queues the delayed
> work after port_stop() has returned.
> 
> The delayed work can then run after devres has freed pmic_typec_port.
> 
> Use disable_delayed_work_sync() in port_stop() to cancel a pending
> instance and prevent the TCPM callbacks from queueing another one.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
> Cc: stable@xxxxxxxxxxxxxxx # v6.10+
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>

Acked-by: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>

> ---
>  drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> index 429bd42a0..fdc379fc4 100644
> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> @@ -694,6 +694,8 @@ static void qcom_pmic_typec_port_stop(struct pmic_typec *tcpm)
>  
>  	for (i = 0; i < pmic_typec_port->nr_irqs; i++)
>  		disable_irq(pmic_typec_port->irq_data[i].irq);
> +
> +	disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
>  }
>  
>  int qcom_pmic_typec_port_probe(struct platform_device *pdev,

-- 
heikki