Re: [PATCH v2 2/2] usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails

[Heikki Krogerus <heikki.krogerus@linux.intel.com>]

On Thu, Aug 20, 2026 at 01:53:07PM +0000, Fan Wu wrote:
> cc_debounce_dwork can be queued before port_start() fails:
> tcpm_register_port() runs first, and its state machine may invoke
> set_cc() or start_toggling() from the TCPM worker.  The error path then
> calls tcpm_unregister_port(), whose worker flush may queue the delayed
> work before devres frees pmic_typec_port.
> 
> Disable and drain the delayed work directly at port_start()'s error
> exit.  Do not use port_stop() for this path: its IRQs use IRQF_NO_AUTOEN
> and are enabled only after a successful port_start().
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
> Cc: stable@vger.kernel.org # v6.10+
> Suggested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
>  drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> index fdc379fc4..53c143364 100644
> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> @@ -684,6 +684,9 @@ static int qcom_pmic_typec_port_start(struct pmic_typec *tcpm,
>  		enable_irq(pmic_typec_port->irq_data[i].irq);
>  
>  done:
> +	if (ret)
> +		disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
> +
>  	return ret;
>  }
>  

-- 
heikki