Re: [PATCH 4/4] ASoC: wm8994: drain all delayed works on component remove

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ASoC: wm8994: uninitialized mic_work cancel in wm8994_component_remove()
--

commit fac5aa258b308d77c115320a9d762e1310e3f8f2
Author: Tristan Madani <tristan@talencesecurity.com>

ASoC: wm8994: drain all delayed works on component remove

This commit cancels jackdet_bootstrap, mic_complete_work, mic_work, and
open_circuit_work synchronously in wm8994_component_remove() after freeing
IRQs and before releasing firmware.

> diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
> index 6b91e02f130b3..59b9cdcd5fc6a 100644
> --- a/sound/soc/codecs/wm8994.c
> +++ b/sound/soc/codecs/wm8994.c
> @@ -4636,6 +4636,10 @@ static void wm8994_component_remove(struct snd_soc_component *component)
>  			free_irq(wm8994->micdet_irq, wm8994);
>  		break;
>  	}
> +	cancel_delayed_work_sync(&wm8994->jackdet_bootstrap);
> +	cancel_delayed_work_sync(&wm8994->mic_complete_work);
> +	cancel_delayed_work_sync(&wm8994->mic_work);

[Severity: High]
In sound/soc/codecs/wm8994.c, wm8994_component_probe() only initializes
wm8994->mic_work when control->type is WM8994 or WM1811:

	switch (control->type) {
	case WM8994:
		INIT_DELAYED_WORK(&wm8994->mic_work, wm8994_mic_work);
		break;
	case WM1811:
		INIT_DELAYED_WORK(&wm8994->mic_work, wm1811_mic_work);
		break;
	default:
		break;
	}

When control->type is WM8958, wm8994->mic_work is left zero-initialized
with work.func == NULL and an uninitialized timer.

Won't calling cancel_delayed_work_sync(&wm8994->mic_work) unconditionally
in wm8994_component_remove() on a WM8958 device trigger WARN_ON(!work->func)
via __cancel_work_sync() -> __flush_work(), as well as an uninitialized
timer warning in timer_delete() when debug objects are enabled?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026112212.2519775-1-tristmd@gmail.com?part=4