ssusb_otg_switch_exit() drains otg_sx->dr_work with cancel_work_sync(). A later queue_work() from ssusb_set_mode() arms it again. Callers that outlive the cancel are the role-switch store, ssusb_id_notifier(), and the manual-DRD debugfs mode file. The role switch is unregistered on the next line. The extcon notifier is devm-managed, and extcon_sync() invokes it after dropping edev->lock, so unregister is not a barrier. The mode file is removed only after ssusb_gadget_exit(), ssusb_host_exit() and ssusb_rscs_exit(). The late work calls mtu3_stop() or mtu3_start(), writes IPPC registers and calls pm_runtime_get_sync(). dr_work is embedded in the devm_kzalloc()ed struct ssusb_mtk. disable_work_sync() rejects a later queue_work() and drains an item already pending or running. Exit does not enable the work again. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 18cfd7b85ced ("usb: mtu3: rebuild role switch flow of extcon") Cc: stable@vger.kernel.org # 6.10+ Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/usb/mtu3/mtu3_dr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/mtu3/mtu3_dr.c b/drivers/usb/mtu3/mtu3_dr.c index ffa5b9401dad..262922057b13 100644 --- a/drivers/usb/mtu3/mtu3_dr.c +++ b/drivers/usb/mtu3/mtu3_dr.c @@ -326,6 +326,6 @@ void ssusb_otg_switch_exit(struct ssusb_mtk *ssusb) { struct otg_switch_mtk *otg_sx = &ssusb->otg_switch; - cancel_work_sync(&otg_sx->dr_work); + disable_work_sync(&otg_sx->dr_work); usb_role_switch_unregister(otg_sx->role_sw); } base-commit: 238650ef6c7c7cca08e032527329424c9fbd70e5 -- 2.53.0