Linux LED subsystem development
 help / color / mirror / Atom feed
From: Danish Khateeb <danishkhateeb03@gmail.com>
To: Lee Jones <lee@kernel.org>, Pavel Machek <pavel@kernel.org>
Cc: Andrew Davis <afd@ti.com>,
	linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org,
	Danish Khateeb <danishkhateeb03@gmail.com>
Subject: [PATCH v3 2/2] leds: tca6507: Turn the LEDs off on unbind
Date: Wed, 28 Oct 2026 12:43:48 -0500	[thread overview]
Message-ID: <20261028174348.64014-3-danishkhateeb03@gmail.com> (raw)
In-Reply-To: <20261028174348.64014-1-danishkhateeb03@gmail.com>

Unregistering an LED that is on turns it off, and the driver does that
from its work, which is queued from led_assign(). On unbind the work is
then cancelled by devres, so if it has not run yet the LED stays on after
the driver is gone.

Flush the work instead of cancelling it. By the time the devres action
runs, the LEDs and the GPIO chip have been unregistered, and the work
does not queue itself, so nothing can queue it again.

Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
---
 drivers/leds/leds-tca6507.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c
index 0f987e551f03..ffad476af625 100644
--- a/drivers/leds/leds-tca6507.c
+++ b/drivers/leds/leds-tca6507.c
@@ -71,7 +71,6 @@
  * not recognised when matching.
  */
 
-#include <linux/devm-helpers.h>
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/leds.h>
@@ -712,6 +711,11 @@ static const struct of_device_id __maybe_unused of_tca6507_leds_match[] = {
 };
 MODULE_DEVICE_TABLE(of, of_tca6507_leds_match);
 
+static void tca6507_flush_work(void *work)
+{
+	flush_work(work);
+}
+
 static int tca6507_probe(struct i2c_client *client)
 {
 	struct device *dev = &client->dev;
@@ -738,7 +742,8 @@ static int tca6507_probe(struct i2c_client *client)
 	tca->client = client;
 	spin_lock_init(&tca->lock);
 
-	err = devm_work_autocancel(dev, &tca->work, tca6507_work);
+	INIT_WORK(&tca->work, tca6507_work);
+	err = devm_add_action_or_reset(dev, tca6507_flush_work, &tca->work);
 	if (err)
 		return err;
 
-- 
2.56.0


  parent reply	other threads:[~2026-10-28 17:43 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-28 17:43 [PATCH v3 0/2] leds: tca6507: Fix use-after-free on unbind and turn the LEDs off Danish Khateeb
2026-10-28 17:43 ` [PATCH v3 1/2] leds: tca6507: Fix use-after-free on unbind Danish Khateeb
2026-10-28 17:47   ` sashiko-bot
2026-10-28 17:43 ` Danish Khateeb [this message]
2026-10-28 17:51   ` [PATCH v3 2/2] leds: tca6507: Turn the LEDs off " sashiko-bot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261028174348.64014-3-danishkhateeb03@gmail.com \
    --to=danishkhateeb03@gmail.com \
    --cc=afd@ti.com \
    --cc=lee@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-leds@vger.kernel.org \
    --cc=pavel@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox