Re: [PATCH] usb: typec: tcpci: free IRQ before unregistering TCPM port

[Xu Yang]

On Fri, Nov 06, 2026 at 12:45:48PM +0800, zhang san wrote:
> Hi Xu,
> 
> Thanks for the review.
> 
> You are right that tcpci_remove() clears TCPC_ALERT_MASK before
> unregistering the TCPM port. However, this prevents subsequent chip
> alerts; it does not synchronize with a threaded IRQ handler that was
> already woken or running before the mask write.
> 
> In particular, tcpci_irq() can call tcpm_cc_change(), which queues
> event_work on port->wq. Meanwhile, tcpm_unregister_port() destroys that
> worker. An in-flight IRQ thread can therefore reach
> kthread_queue_work() after the worker has been destroyed.
> 
> We reproduced this ordering on a KASAN-enabled 7.4-rc1 kernel using a
> simulated I2C TCPCI device. A kprobe paused the real threaded handler
> immediately before kthread_queue_work() while another CPU unbound the
> device.
> 
> Without the patch, TCPM worker teardown completed before the handler
> resumed, and KASAN reported a slab-use-after-free in
> kthread_queue_work().
> 
> With the patch, devm_free_irq() waited for the handler to finish before
> tcpci_unregister_port() destroyed the worker, and the same test produced
> no KASAN report.
> 
> This is an injection-assisted reproduction, not a measurement of how
> often the race occurs on physical hardware. It demonstrates that
> masking the chip alert does not by itself exclude an already in-flight
> threaded handler.
> 
> I would be happy to provide further details of the interleaving or test
> setup if useful.

OK. 

I think synchronize_irq() would be more suitable for this case. Otherwise,
using devm_* would lose its purpose.

Thanks,
Xu Yang