The writable gpio_mode_enforce parameter can change between probe and remove. If it changes from false to true after probe, remove skips cancellation of init_work. Pending or running work can then access devm-managed driver state after teardown. Changing it from true to false can make remove cancel an uninitialized delayed work item. Initialize init_work whenever IIO is reachable and cancel it unconditionally on remove. Keep the parameter check only for scheduling the initialization. The false-to-true cancellation gap was previously reported by Sashiko. We also encountered this issue during our static-analysis research. Fixes: 200e6c6e94fa ("HID: mcp2221: Add module parameter to enfoce GPIO mode") Reported-by: Sashiko Link: https://lore.kernel.org/linux-input/20260715143415.916A21F00A3A@smtp.kernel.org/ Assisted-by: LLM Cc: stable@vger.kernel.org Signed-off-by: Myeonghun Pak --- drivers/hid/hid-mcp2221.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c index d52ce3531ab706db8ec908d57ad0383af9fafb1e..6515692b408ee7b6ee318cfa3f240321c133f2c4 100644 --- a/drivers/hid/hid-mcp2221.c +++ b/drivers/hid/hid-mcp2221.c @@ -1072,8 +1072,7 @@ static void mcp2221_remove(struct hid_device *hdev) #if IS_REACHABLE(CONFIG_IIO) struct mcp2221 *mcp = hid_get_drvdata(hdev); - if (!gpio_mode_enforce) - cancel_delayed_work_sync(&mcp->init_work); + cancel_delayed_work_sync(&mcp->init_work); #endif } @@ -1347,10 +1346,9 @@ static int mcp2221_probe(struct hid_device *hdev, #endif #if IS_REACHABLE(CONFIG_IIO) - if (!gpio_mode_enforce) { - INIT_DELAYED_WORK(&mcp->init_work, mcp_init_work); + INIT_DELAYED_WORK(&mcp->init_work, mcp_init_work); + if (!gpio_mode_enforce) schedule_delayed_work(&mcp->init_work, msecs_to_jiffies(100)); - } #endif return 0;