From: Tristan Madani The driver schedules wq_detcable as a delayed work during probe but the remove callback only tears down the regmap IRQ chip and never cancels it. If the device is unbound before the work fires, the callback dereferences freed memory because the driver data is managed by devm. Use devm_delayed_work_autocancel() so the work is automatically cancelled when the device is removed. Fixes: c03e017c4d3d ("extcon: rt8973a: Add Richtek RT8973A extcon driver") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/extcon/extcon-rt8973a.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/extcon/extcon-rt8973a.c b/drivers/extcon/extcon-rt8973a.c index 19bb49f13fb08..184e9f4c16ce3 100644 --- a/drivers/extcon/extcon-rt8973a.c +++ b/drivers/extcon/extcon-rt8973a.c @@ -6,6 +6,7 @@ * Author: Chanwoo Choi */ +#include #include #include #include @@ -635,7 +636,10 @@ static int rt8973a_muic_i2c_probe(struct i2c_client *i2c) * After completing the booting of platform, the extcon provider * driver should notify cable state to upper layer. */ - INIT_DELAYED_WORK(&info->wq_detcable, rt8973a_muic_detect_cable_wq); + ret = devm_delayed_work_autocancel(&i2c->dev, &info->wq_detcable, + rt8973a_muic_detect_cable_wq); + if (ret) + return ret; queue_delayed_work(system_power_efficient_wq, &info->wq_detcable, msecs_to_jiffies(DELAY_MS_DEFAULT)); -- 2.47.3