[PATCH] mfd: cs42l43: cancel boot work during remove

[PATCH] mfd: cs42l43: cancel boot work during remove

[Hongyan Xu]

Probe queues boot_work on system_long_wq, but both transport remove
callbacks release the devm-allocated CS42L43 data without waiting for it.

Cancel the work before powering the device down. Balance the runtime-PM
reference when pending work is cancelled, and have the worker call the
power-down helper directly on error to avoid cancelling itself.

This issue was found by a static analysis tool.

Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/mfd/cs42l43.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
index 7b6d07c..411566e 100644
--- a/drivers/mfd/cs42l43.c
+++ b/drivers/mfd/cs42l43.c
@@ -868,6 +868,8 @@ static int cs42l43_irq_config(struct cs42l43 *cs42l43)
 	return 0;
 }
 
+static int cs42l43_power_down(struct cs42l43 *cs42l43);
+
 static void cs42l43_boot_work(struct work_struct *work)
 {
 	struct cs42l43 *cs42l43 = container_of(work, struct cs42l43, boot_work);
@@ -937,7 +939,7 @@ static void cs42l43_boot_work(struct work_struct *work)
 
 err:
 	pm_runtime_put_sync(cs42l43->dev);
-	cs42l43_dev_remove(cs42l43);
+	cs42l43_power_down(cs42l43);
 }
 
 static int cs42l43_power_up(struct cs42l43 *cs42l43)
@@ -1069,6 +1071,8 @@ EXPORT_SYMBOL_NS_GPL(cs42l43_dev_probe, MFD_CS42L43);
 
 void cs42l43_dev_remove(struct cs42l43 *cs42l43)
 {
+	if (cancel_work_sync(&cs42l43->boot_work))
+		pm_runtime_put_noidle(cs42l43->dev);
 	cs42l43_power_down(cs42l43);
 }
 EXPORT_SYMBOL_NS_GPL(cs42l43_dev_remove, MFD_CS42L43);
-- 
2.50.1.windows.1

Re: [PATCH] mfd: cs42l43: cancel boot work during remove

[Charles Keepax]

On Tue, Jul 28, 2026 at 02:55:56PM +0800, Hongyan Xu wrote:
> Probe queues boot_work on system_long_wq, but both transport remove
> callbacks release the devm-allocated CS42L43 data without waiting for it.
> 
> Cancel the work before powering the device down. Balance the runtime-PM
> reference when pending work is cancelled, and have the worker call the
> power-down helper directly on error to avoid cancelling itself.
> 
> This issue was found by a static analysis tool.
> 
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
>  drivers/mfd/cs42l43.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
> index 7b6d07c..411566e 100644
> --- a/drivers/mfd/cs42l43.c
> +++ b/drivers/mfd/cs42l43.c
> @@ -868,6 +868,8 @@ static int cs42l43_irq_config(struct cs42l43 *cs42l43)
>  	return 0;
>  }
>  
> +static int cs42l43_power_down(struct cs42l43 *cs42l43);
> +
>  static void cs42l43_boot_work(struct work_struct *work)
>  {
>  	struct cs42l43 *cs42l43 = container_of(work, struct cs42l43, boot_work);
> @@ -937,7 +939,7 @@ static void cs42l43_boot_work(struct work_struct *work)
>  
>  err:
>  	pm_runtime_put_sync(cs42l43->dev);
> -	cs42l43_dev_remove(cs42l43);
> +	cs42l43_power_down(cs42l43);
>  }
>  
>  static int cs42l43_power_up(struct cs42l43 *cs42l43)
> @@ -1069,6 +1071,8 @@ EXPORT_SYMBOL_NS_GPL(cs42l43_dev_probe, MFD_CS42L43);
>  
>  void cs42l43_dev_remove(struct cs42l43 *cs42l43)
>  {
> +	if (cancel_work_sync(&cs42l43->boot_work))
> +		pm_runtime_put_noidle(cs42l43->dev);
>  	cs42l43_power_down(cs42l43);
>  }

This looks like it is based off a very old kernel, this was
already fixed back in October 2024. Please make sure to rebase
your submissions on ideally the maintainers tree, but at a
minimum Linus's tree.

Thanks,
Charles