[PATCH v5 3/7] phy: cpcap-usb: fix IRQ teardown race
From: Ivaylo Dimitrov <hidden>
Date: 2026-07-11 20:42:46
Also in:
linux-gpio, linux-omap, lkml
Subsystem:
generic phy framework, the rest · Maintainers:
Vinod Koul, Linus Torvalds
there is a race between IRQ handler and remove:
IRQ thread:
ddata->active == 1
remove():
ddata->active = 0
cancel_delayed_work_sync()
IRQ thread:
schedule_delayed_work()
The IRQ handler can therefore queue detect work after it has been canceled
during remove(). Free the IRQ handlers before canceling detect work to
prevent new work from being scheduled during teardown.
Reported by Sashiko
Signed-off-by: Ivaylo Dimitrov <redacted>
---
drivers/phy/motorola/phy-cpcap-usb.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c
index 7cb020dd3423..741145c89e5b 100644
--- a/drivers/phy/motorola/phy-cpcap-usb.c
+++ b/drivers/phy/motorola/phy-cpcap-usb.c@@ -393,6 +393,19 @@ static int cpcap_usb_init_interrupts(struct platform_device *pdev, return 0; } +static void cpcap_usb_fini_interrupts(struct platform_device *pdev, + struct cpcap_phy_ddata *ddata) +{ + int i, irq; + + for (i = 0; i < ARRAY_SIZE(cpcap_phy_irqs); i++) { + irq = platform_get_irq_byname(pdev, cpcap_phy_irqs[i]); + + if (irq >= 0) + devm_free_irq(ddata->dev, irq, ddata); + } +} + /* * Optional pins and modes. At least Motorola mapphone devices * are using two GPIOs and dynamic pinctrl to multiplex PHY pins
@@ -691,6 +704,8 @@ static void cpcap_usb_phy_remove(struct platform_device *pdev) int error; atomic_set(&ddata->active, 0); + cpcap_usb_fini_interrupts(pdev, ddata); + cancel_delayed_work_sync(&ddata->detect_work); error = cpcap_usb_set_uart_mode(ddata); if (error) dev_err(ddata->dev, "could not set UART mode\n");
@@ -698,7 +713,6 @@ static void cpcap_usb_phy_remove(struct platform_device *pdev) cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF); usb_remove_phy(&ddata->phy); - cancel_delayed_work_sync(&ddata->detect_work); regulator_disable(ddata->vusb); }
--
2.39.5