[PATCH 04/10] regulator: arizona-micsupp: Cancel check_cp_work on device teardown

[Lee Jones]

micsupp->check_cp_work is initialised with raw INIT_WORK() and is never
cancelled when the regulator device is unbound or when registration
fails after set_machine_constraints() has run, allowing a pending work
item to dereference micsupp after devres frees it.

Initialise check_cp_work with devm_work_autocancel() before registering
the regulator so the work item is cancelled after regulator teardown and
before micsupp is freed.

Fixes: e6ed90581bfa ("regulator: arizona-micsupp: Enable SYSCLK for charge pump")
Closes: https://sashiko.dev/#/bug/linux-3f85eadb-7493-4aea-9e4d-ce319b6e0688
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
 drivers/regulator/arizona-micsupp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/arizona-micsupp.c b/drivers/regulator/arizona-micsupp.c
index be7208bc7409..70b939d3e704 100644
--- a/drivers/regulator/arizona-micsupp.c
+++ b/drivers/regulator/arizona-micsupp.c
@@ -10,6 +10,7 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/bitops.h>
+#include <linux/devm-helpers.h>
 #include <linux/err.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
@@ -255,7 +256,10 @@ static int arizona_micsupp_common_init(struct platform_device *pdev,
 	struct regulator_config config = { };
 	int ret;
 
-	INIT_WORK(&micsupp->check_cp_work, arizona_micsupp_check_cp);
+	ret = devm_work_autocancel(&pdev->dev, &micsupp->check_cp_work,
+				   arizona_micsupp_check_cp);
+	if (ret)
+		return ret;
 
 	micsupp->init_data.consumer_supplies = &micsupp->supply;
 	micsupp->supply.dev_name = dev_name(micsupp->dev);
-- 
2.56.0.385.gac671c819a-goog