[PATCH] bus: mhi: ep: cancel reset work during controller teardown

[PATCH] bus: mhi: ep: cancel reset work during controller teardown

[Jiale Yao]

The doorbell IRQ schedules reset_work on the system workqueue when the
host requests an MHI reset. The controller teardown only drains the
private MHI workqueue before releasing the controller state, so
reset_work can still run after that state has been freed.

Cancel reset_work before destroying the private workqueue and releasing
the controller resources. The caller is required to power down the
controller first, so the IRQ can no longer queue the work at this point.

Fixes: 7a97b6b47353 ("bus: mhi: ep: Add support for handling MHI_RESET")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/bus/mhi/ep/main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
index db7ee6547eef..a9695e1a75ab 100644
--- a/drivers/bus/mhi/ep/main.c
+++ b/drivers/bus/mhi/ep/main.c
@@ -1596,6 +1596,7 @@ void mhi_ep_unregister_controller(struct mhi_ep_cntrl *mhi_cntrl)
 {
 	struct mhi_ep_device *mhi_dev = mhi_cntrl->mhi_dev;
 
+	cancel_work_sync(&mhi_cntrl->reset_work);
 	destroy_workqueue(mhi_cntrl->wq);
 
 	free_irq(mhi_cntrl->irq, mhi_cntrl);
-- 
2.34.1

Re: [PATCH] bus: mhi: ep: cancel reset work during controller teardown

[Greg Kroah-Hartman]

On Sun, Oct 18, 2026 at 12:06:14PM +0800, Jiale Yao wrote:
> The doorbell IRQ schedules reset_work on the system workqueue when the
> host requests an MHI reset. The controller teardown only drains the
> private MHI workqueue before releasing the controller state, so
> reset_work can still run after that state has been freed.
> 
> Cancel reset_work before destroying the private workqueue and releasing
> the controller resources. The caller is required to power down the
> controller first, so the IRQ can no longer queue the work at this point.
> 
> Fixes: 7a97b6b47353 ("bus: mhi: ep: Add support for handling MHI_RESET")
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/bus/mhi/ep/main.c | 1 +
>  1 file changed, 1 insertion(+)

How was this found and tested?  What about a cc: stable?

thanks,

greg k-h