[PATCH v2 1/3] fbdev: pxafb: unregister cpufreq notifier on removal

[Matthias Goergens]

pxafb_probe() registers a cpufreq transition notifier, but
pxafb_remove() never unregisters it.  The notifier block is part of
struct pxafb_info, which is devm-allocated and freed after removal, so
once the driver is unbound or the module unloaded, the next CPU
frequency change calls pxafb_freq_transition() through freed memory.

Unregister the notifier in pxafb_remove().

Sashiko, the AI review bot, pointed this out while reviewing a pxafb
cleanup.  I have no PXA hardware; this is build-tested only.

Link: https://lore.kernel.org/all/20260722081427.413EF1F000E9@xxxxxxxxxxxxxxx/
Fixes: 9f17f2874834 ("[ARM] 5118/1: pxafb: add exit and remove handlers")
Signed-off-by: Matthias Goergens <matthias.goergens@xxxxxxxxx>
---
 drivers/video/fbdev/pxafb.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
index 1682345fb9b0..4f5c408eae56 100644
--- a/drivers/video/fbdev/pxafb.c
+++ b/drivers/video/fbdev/pxafb.c
@@ -2384,6 +2384,10 @@ static void pxafb_remove(struct platform_device *dev)
 
 	info = &fbi->fb;
 
+#ifdef CONFIG_CPU_FREQ
+	cpufreq_unregister_notifier(&fbi->freq_transition,
+				    CPUFREQ_TRANSITION_NOTIFIER);
+#endif
 	pxafb_overlay_exit(fbi);
 	cancel_work_sync(&fbi->task);
 	unregister_framebuffer(info);
-- 
2.56.0