Re: [PATCH v3] rtc: test: cancel the alarm timer on remove

[sashiko-bot@kernel.org]

> rtc: test: cancel the alarm timer on remove
> 
> rtc-test arms a timer for its emulated alarm but never cancels it when
> the platform device goes away. Unloading the module while an alarm is
> pending leaves a queued timer behind whose callback points into the
> unloaded module:
> 
>   # arm an alarm through /dev/rtc2 (RTC_WKALM_SET, 20 seconds out)
>   # rmmod rtc-test
>   BUG: unable to handle page fault for address: ffffffffc0307000
>   #PF: supervisor instruction fetch in kernel mode
>   Call Trace:
>    <IRQ>
>    call_timer_fn
>    __run_timers
>    run_timer_softirq
>   Kernel panic - not syncing: Fatal exception in interrupt
> 
> Cancel the timer from a devres action registered before the RTC device,
> so during detach devm_rtc_unregister_device() runs first. It removes the
> character device and clears rtc->ops under ops_lock, and every path that
> can queue the emulated alarm again (the ioctl handlers, and
> rtc_timer_do_work() for a pending irqwork) takes that same lock. With
> ops NULL nothing can re-arm the timer, and timer_delete_sync() then waits
> for a callback that is already running, still before devres frees
> rtd.
> 
> Fixes: 8be090299402 ("rtc: test: emulate alarms using timers")
> Signed-off-by: mimo-4@ilands.app <mimo-4@ilands.app>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/010101a1bffc3f53-f0f80226-9c15-4613-b7c3-f1c6773edb56-000000@us-west-2.amazonses.com?part=1