max77843_muic_remove() cancels irq_work before removing the IRQ chip, so an interrupt can queue it again before the MUIC regmap and driver data are freed. The probe error path does not cancel the work at all. Cancel irq_work after regmap_del_irq_chip() stops its producer and before unregistering the MUIC I2C client. Apply the same ordering to the probe error path and initialize the work before that path is used. Found by a static analysis tool under development. Compile-tested with W=1 for arm64 and x86_64. Not tested on hardware. Fixes: 27a28d32b4f2 ("extcon: max77843: Add max77843 MUIC driver") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- Based on next-20261109 without Hongyan Xu's cable-detection fix [1]. The patches conflict textually; if [1] is applied first, keep its cancel_delayed_work_sync() at the start of max77843_muic_remove(). [1] https://lore.kernel.org/all/20260728075429.838-1-getshell@seu.edu.cn/ drivers/extcon/extcon-max77843.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/extcon/extcon-max77843.c b/drivers/extcon/extcon-max77843.c index c16606b23855..0d45c374fcb4 100644 --- a/drivers/extcon/extcon-max77843.c +++ b/drivers/extcon/extcon-max77843.c @@ -825,6 +825,9 @@ static int max77843_muic_probe(struct platform_device *pdev) platform_set_drvdata(pdev, info); mutex_init(&info->mutex); + /* Support virtual irq domain for max77843 MUIC device */ + INIT_WORK(&info->irq_work, max77843_muic_irq_work); + /* Initialize i2c and regmap */ ret = max77843_init_muic_regmap(max77843); if (ret) { @@ -879,9 +882,6 @@ static int max77843_muic_probe(struct platform_device *pdev) } dev_info(info->dev, "MUIC device ID : 0x%x\n", id); - /* Support virtual irq domain for max77843 MUIC device */ - INIT_WORK(&info->irq_work, max77843_muic_irq_work); - /* Clear IRQ bits before request IRQs */ ret = regmap_bulk_read(max77843->regmap_muic, MAX77843_MUIC_REG_INT1, info->status, @@ -923,6 +923,7 @@ static int max77843_muic_probe(struct platform_device *pdev) err_muic_irq: regmap_del_irq_chip(max77843->irq, max77843->irq_data_muic); + cancel_work_sync(&info->irq_work); i2c_unregister_device(max77843->i2c_muic); return ret; @@ -933,8 +934,8 @@ static void max77843_muic_remove(struct platform_device *pdev) struct max77843_muic_info *info = platform_get_drvdata(pdev); struct max77693_dev *max77843 = info->max77843; - cancel_work_sync(&info->irq_work); regmap_del_irq_chip(max77843->irq, max77843->irq_data_muic); + cancel_work_sync(&info->irq_work); i2c_unregister_device(max77843->i2c_muic); } base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47 -- 2.43.0