pwm_gpio_probe() registers the chip with pwmchip_add(), but the driver has neither a remove callback nor a devm action calling pwmchip_remove(). On unbind the devres callbacks release the GPIO descriptor, cancel the hrtimer and drop the reference taken by devm_pwmchip_alloc(), while the chip stays registered: it is still in the pwm_chips idr, its sysfs attributes and character device are still there and chip->operational is still true. The chip can therefore still be reached through sysfs export, the character device, debugfs and pwm_get() from a consumer. Those paths call into chip->ops, which point into unloaded module text once the module is gone, and pwm_gpio_apply() re-arms the cancelled hrtimer and drives a GPIO descriptor the driver no longer owns. Use devm_pwmchip_add() so that the chip is removed before the hrtimer is cancelled and the GPIO is released. Fixes: 7f61257cd6e1 ("pwm: Add GPIO PWM driver") Cc: stable@vger.kernel.org Signed-off-by: Yu Zhang --- drivers/pwm/pwm-gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pwm/pwm-gpio.c b/drivers/pwm/pwm-gpio.c index 5644d78..cffdbcd 100644 --- a/drivers/pwm/pwm-gpio.c +++ b/drivers/pwm/pwm-gpio.c @@ -212,7 +212,7 @@ static int pwm_gpio_probe(struct platform_device *pdev) if (ret) return ret; - ret = pwmchip_add(chip); + ret = devm_pwmchip_add(dev, chip); if (ret < 0) return dev_err_probe(dev, ret, "could not add pwmchip\n"); -- 2.43.0