[PATCH] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[PATCH] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[Fan Wu]

cc_debounce_dwork lives on the system workqueue but is armed from
tcpm callbacks (set_cc/start_toggling).  Those callbacks run on tcpm's
kthread worker which is only destroyed by tcpm_unregister_port(), after
port_stop() has already returned, opening a potential race window where
tcpm's worker flush re-arms the work.

Use disable_delayed_work_sync() in port_stop() to cancel any pending
instance and prevent future schedule_delayed_work() calls from
succeeding.  Also unwind a failed port_start() through port_stop(),
which otherwise jumps straight to tcpm_unregister_port() and leaves
the same window open after a failed probe.

This issue was found by an in-house static analysis tool.

Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
Cc: stable@vger.kernel.org # v6.10+
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c      | 3 +--
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 2 ++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
index 35320f89d..f42c9e65f 100644
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
@@ -101,7 +101,7 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)
 
 	ret = tcpm->port_start(tcpm, tcpm->tcpm_port);
 	if (ret)
-		goto port_unregister;
+		goto port_stop;
 
 	ret = tcpm->pdphy_start(tcpm, tcpm->tcpm_port);
 	if (ret)
@@ -117,7 +117,6 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)
 	tcpm->pdphy_stop(tcpm);
 port_stop:
 	tcpm->port_stop(tcpm);
-port_unregister:
 	tcpm_unregister_port(tcpm->tcpm_port);
 fwnode_remove:
 	fwnode_handle_put(tcpm->tcpc.fwnode);
diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
index 429bd42a0..fdc379fc4 100644
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
@@ -694,6 +694,8 @@ static void qcom_pmic_typec_port_stop(struct pmic_typec *tcpm)
 
 	for (i = 0; i < pmic_typec_port->nr_irqs; i++)
 		disable_irq(pmic_typec_port->irq_data[i].irq);
+
+	disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
 }
 
 int qcom_pmic_typec_port_probe(struct platform_device *pdev,

Re: [PATCH] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[Konrad Dybcio]

On 8/19/26 6:19 PM, Fan Wu wrote:
> cc_debounce_dwork lives on the system workqueue but is armed from
> tcpm callbacks (set_cc/start_toggling).  Those callbacks run on tcpm's
> kthread worker which is only destroyed by tcpm_unregister_port(), after
> port_stop() has already returned, opening a potential race window where
> tcpm's worker flush re-arms the work.

[...]

> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> @@ -694,6 +694,8 @@ static void qcom_pmic_typec_port_stop(struct pmic_typec *tcpm)
>  
>  	for (i = 0; i < pmic_typec_port->nr_irqs; i++)
>  		disable_irq(pmic_typec_port->irq_data[i].irq);
> +
> +	disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);

Doesn't this make disable_irq() get called undesirably?

Konrad

Re: [PATCH] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[Fan Wu]

> On Aug 20, 2026, at 16:13, Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> wrote:
> 
> Doesn't this make disable_irq() get called undesirably?
> 
> Konrad

Hi Konrad,

Thanks for pointing this out.

On the port_start() failure path the port IRQs have indeed not been
enabled: they are requested with IRQF_NO_AUTOEN, and the enable_irq()
loop is the last step in port_start(). Routing that path through
port_stop() therefore adds a nested disable_irq() on already-disabled
IRQs. __disable_irq() only acts when the depth goes 0 -> 1, so this
is just a counter bump on that leg — no hardware access, no warning,
and devm frees those IRQs right after on the same unwind. But I agree
it is not an ideal cleanup contract.

The reason I routed it through port_stop() is to make sure
cc_debounce_dwork is disabled and drained before tcpm_unregister_port().
tcpm_register_port() runs before port_start() and may already have
queued the TCPM state machine; that worker can call set_cc() or
start_toggling() and arm the delayed work even when port_start() later
fails.

If you find the extra disable_irq() undesirable I will revise the
cleanup so the failed-start path only disables/drains the delayed work,
leaving port_stop() for the paths where the port was actually started,
and send an updated patch.

Thanks,
Fan

Re: [PATCH] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[Bryan O'Donoghue]

On 19/08/2026 17:19, Fan Wu wrote:
> cc_debounce_dwork lives on the system workqueue but is armed from
> tcpm callbacks (set_cc/start_toggling).  Those callbacks run on tcpm's
> kthread worker which is only destroyed by tcpm_unregister_port(), after
> port_stop() has already returned, opening a potential race window where
> tcpm's worker flush re-arms the work.
> 
> Use disable_delayed_work_sync() in port_stop() to cancel any pending
> instance and prevent future schedule_delayed_work() calls from
> succeeding.  Also unwind a failed port_start() through port_stop(),
> which otherwise jumps straight to tcpm_unregister_port() and leaves
> the same window open after a failed probe.

I'd prefer to see two patches broken at the "also" in the above statement.

> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
> Cc: stable@vger.kernel.org # v6.10+
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
> ---
>   drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c      | 3 +--
>   drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 2 ++
>   2 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
> index 35320f89d..f42c9e65f 100644
> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
> @@ -101,7 +101,7 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)
>   
>   	ret = tcpm->port_start(tcpm, tcpm->tcpm_port);
>   	if (ret)
> -		goto port_unregister;
> +		goto port_stop;
>   
>   	ret = tcpm->pdphy_start(tcpm, tcpm->tcpm_port);
>   	if (ret)
> @@ -117,7 +117,6 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)
>   	tcpm->pdphy_stop(tcpm);
>   port_stop:
>   	tcpm->port_stop(tcpm);
> -port_unregister:
>   	tcpm_unregister_port(tcpm->tcpm_port);
>   fwnode_remove:
>   	fwnode_handle_put(tcpm->tcpc.fwnode);
> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> index 429bd42a0..fdc379fc4 100644
> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> @@ -694,6 +694,8 @@ static void qcom_pmic_typec_port_stop(struct pmic_typec *tcpm)
>   
>   	for (i = 0; i < pmic_typec_port->nr_irqs; i++)
>   		disable_irq(pmic_typec_port->irq_data[i].irq);
> +
> +	disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
>   }
>   
>   int qcom_pmic_typec_port_probe(struct platform_device *pdev,
> 

[PATCH v2 0/2] usb: typec: qcom-pmic-typec: cc_debounce_dwork lifetime fixes

[Fan Wu]

This is v2 of "usb: typec: qcom-pmic-typec: disable cc_debounce_dwork
on stop", split at the "also" as Bryan asked: patch 1 fixes the
stop/remove path, patch 2 the probe-failure path.

Changes in v2:
- Split the probe-failure handling into its own patch (Bryan).
- The failed port_start() path now drains the delayed work at the
  port_start() error exit instead of unwinding through port_stop(), so
  the IRQF_NO_AUTOEN IRQs, which are only enabled at the end of a
  successful port_start(), are not disabled unnecessarily (Konrad).

Fan Wu (2):
  usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
  usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start()
    fails

 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 5 +++++
 1 file changed, 5 insertions(+)

[PATCH v2 1/2] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[Fan Wu]

cc_debounce_dwork is queued from the set_cc() and start_toggling()
callbacks, which run from TCPM's kthread worker.  port_stop() returns
before tcpm_unregister_port() destroys that worker.  Flushing the worker
during unregister may therefore run a callback which queues the delayed
work after port_stop() has returned.

The delayed work can then run after devres has freed pmic_typec_port.

Use disable_delayed_work_sync() in port_stop() to cancel a pending
instance and prevent the TCPM callbacks from queueing another one.

This issue was found by an in-house static analysis tool.

Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
Cc: stable@vger.kernel.org # v6.10+
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
index 429bd42a0..fdc379fc4 100644
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
@@ -694,6 +694,8 @@ static void qcom_pmic_typec_port_stop(struct pmic_typec *tcpm)
 
 	for (i = 0; i < pmic_typec_port->nr_irqs; i++)
 		disable_irq(pmic_typec_port->irq_data[i].irq);
+
+	disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
 }
 
 int qcom_pmic_typec_port_probe(struct platform_device *pdev,

Re: [PATCH v2 1/2] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

[Heikki Krogerus]

On Thu, Aug 20, 2026 at 01:53:06PM +0000, Fan Wu wrote:
> cc_debounce_dwork is queued from the set_cc() and start_toggling()
> callbacks, which run from TCPM's kthread worker.  port_stop() returns
> before tcpm_unregister_port() destroys that worker.  Flushing the worker
> during unregister may therefore run a callback which queues the delayed
> work after port_stop() has returned.
> 
> The delayed work can then run after devres has freed pmic_typec_port.
> 
> Use disable_delayed_work_sync() in port_stop() to cancel a pending
> instance and prevent the TCPM callbacks from queueing another one.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
> Cc: stable@vger.kernel.org # v6.10+
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
>  drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> index 429bd42a0..fdc379fc4 100644
> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> @@ -694,6 +694,8 @@ static void qcom_pmic_typec_port_stop(struct pmic_typec *tcpm)
>  
>  	for (i = 0; i < pmic_typec_port->nr_irqs; i++)
>  		disable_irq(pmic_typec_port->irq_data[i].irq);
> +
> +	disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
>  }
>  
>  int qcom_pmic_typec_port_probe(struct platform_device *pdev,

-- 
heikki

[PATCH v2 2/2] usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails

[Fan Wu]

cc_debounce_dwork can be queued before port_start() fails:
tcpm_register_port() runs first, and its state machine may invoke
set_cc() or start_toggling() from the TCPM worker.  The error path then
calls tcpm_unregister_port(), whose worker flush may queue the delayed
work before devres frees pmic_typec_port.

Disable and drain the delayed work directly at port_start()'s error
exit.  Do not use port_stop() for this path: its IRQs use IRQF_NO_AUTOEN
and are enabled only after a successful port_start().

This issue was found by an in-house static analysis tool.

Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
Cc: stable@vger.kernel.org # v6.10+
Suggested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
index fdc379fc4..53c143364 100644
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
@@ -684,6 +684,9 @@ static int qcom_pmic_typec_port_start(struct pmic_typec *tcpm,
 		enable_irq(pmic_typec_port->irq_data[i].irq);
 
 done:
+	if (ret)
+		disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
+
 	return ret;
 }
 

Re: [PATCH v2 2/2] usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails

[Heikki Krogerus]

On Thu, Aug 20, 2026 at 01:53:07PM +0000, Fan Wu wrote:
> cc_debounce_dwork can be queued before port_start() fails:
> tcpm_register_port() runs first, and its state machine may invoke
> set_cc() or start_toggling() from the TCPM worker.  The error path then
> calls tcpm_unregister_port(), whose worker flush may queue the delayed
> work before devres frees pmic_typec_port.
> 
> Disable and drain the delayed work directly at port_start()'s error
> exit.  Do not use port_stop() for this path: its IRQs use IRQF_NO_AUTOEN
> and are enabled only after a successful port_start().
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
> Cc: stable@vger.kernel.org # v6.10+
> Suggested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
>  drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> index fdc379fc4..53c143364 100644
> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> @@ -684,6 +684,9 @@ static int qcom_pmic_typec_port_start(struct pmic_typec *tcpm,
>  		enable_irq(pmic_typec_port->irq_data[i].irq);
>  
>  done:
> +	if (ret)
> +		disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
> +
>  	return ret;
>  }
>  

-- 
heikki