Re: [PATCH] usb: typec: tcpm: Cancel the timers before destroying the worker too

[sashiko-bot@kernel.org]

> From: Arun Iyengar <aiyengar1990@gmail.com>
> 
> tcpm_unregister_port() clears port->registered, destroys the kthread
> worker and only then cancels the hrtimers. A timer handler running on
> another CPU that has already seen port->registered set can still call
> kthread_queue_work() once the worker is freed, or with port->wq
> already NULL:
> 
>   CPU0                           CPU1
>   tcpm_unregister_port()         state_machine_timer_handler()
>                                    if (port->registered)
>     port->registered = false;
>     kthread_destroy_worker(port->wq);
>     port->wq = NULL;
>                                    kthread_queue_work(port->wq, ...);
> 
> The timers are cancelled after the worker is destroyed on purpose:
> works that run while the worker is flushed can start a timer again
> (see the commit in Fixes). Cancelling only before would bring that
> back, so cancel them on both sides. hrtimer_cancel() waits for a
> handler that is running, so after the first round no handler that
> missed the cleared flag is left; the second round removes a timer that
> a work started during the flush. tcpm_reset_port(), called later, only
> cancels.
> 
> Fixes: ca4d8344a72b ("usb: typec: tcpm: fix tcpm unregister port but leave a pending timer")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/sashiko-outbox-206898@kernel.org/
> Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-tcpm-unregister-timers-v1-1-7230fda5612b@gmail.com?part=1