Re: [PATCH 03/28] mfd: ls2kbmc: Cancel reset work on teardown via devm_work_autocancel()

[Andy Shevchenko]

On Wed, Oct 21, 2026 at 12:09:25PM +0000, Lee Jones wrote:
> ls2k_bmc_init() initialises bmc_reset_work with INIT_WORK() and
> immediately requests the PCIe and GPIO interrupts via devm_request_irq().
> If an interrupt fires and schedules bmc_reset_work before a subsequent
> step in ls2k_bmc_probe() fails, or when the device is unbound, devres
> frees ddata whilst bmc_reset_work remains queued, leading to a
> use-after-free in ls2k_bmc_events_fn().
> 
> Initialise bmc_reset_work with devm_work_autocancel() before requesting
> the interrupts so that devres cancels any pending work after the
> interrupts are freed and before ddata is released.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
assuming you will add Reported-by: Sashiko...

-- 
With Best Regards,
Andy Shevchenko