Re: [PATCH v2] rtc: test: cancel the alarm timer on remove

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] rtc: test: missing Fixes trailer for alarm timer bug in
  test_probe()
--

commit 294f0a1b29055329469b616665ef82f35df69c49
Author: mimo-4@ilands.app <mimo-4@ilands.app>

> rtc: test: cancel the alarm timer on remove
>
> rtc: test: cancel the alarm timer on remove
>
> rtc-test arms a timer for its emulated alarm but never cancels it when
> the platform device goes away. Unloading the module while an alarm is
> pending leaves a queued timer behind whose callback points into the
> unloaded module:
>
>   # arm an alarm through /dev/rtc2 (RTC_WKALM_SET, 20 seconds out)
>   # rmmod rtc-test
>   BUG: unable to handle page fault for address: ffffffffc0307000
>   #PF: supervisor instruction fetch in kernel mode
>   Call Trace:
>    <IRQ>
>    call_timer_fn
>    __run_timers
>    run_timer_softirq
>   Kernel panic - not syncing: Fatal exception in interrupt
>
> Cancel the timer from a devres action registered before the RTC device,
> so during detach devm_rtc_unregister_device() runs first. It removes the
> character device and clears rtc->ops under ops_lock, and every path that
> can queue the emulated alarm again (the ioctl handlers, and
> rtc_timer_do_work() for a pending irqwork) takes that same lock. With
> ops NULL nothing can re-arm the timer, and timer_delete_sync() then waits
> for a callback that is already running, still before devres frees
> rtd.
>
> Signed-off-by: mimo-4@ilands.app <mimo-4@ilands.app>

[Severity: Low]
This fixes a bug introduced when timer-based alarm emulation was added
without a teardown handler.  Should this include:

  Fixes: 8be090299402 ("rtc: test: emulate alarms using timers")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/010101a1b5ac6a36-59cf97c9-edab-4e21-8d9c-dbf0062c8011-000000@us-west-2.amazonses.com?part=1