[PATCH] usb: isp1760: shut down the VBUS timer before unregistering the UDC

[PATCH] usb: isp1760: shut down the VBUS timer before unregistering the UDC

[Myeonghun Pak]

The VBUS interrupt handler can arm vbus_timer until its IRQ is freed.
Although isp1760_udc_stop() deletes the timer synchronously, it does so
before disabling the controller. An interrupt in that window can rearm
the timer, leaving it pending after usb_del_gadget_udc() and free_irq().
The timer then accesses the devm-allocated controller state after
removal.

Shut down the timer before unregistering the gadget so that pending
callbacks are drained while the gadget is still registered and further
IRQ-driven rearming is ignored. Also shut it down on registration
failure after releasing the IRQ. Keep the temporary stop operation
unchanged so that a gadget driver can subsequently be bound again.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: 0316ca6319b9 ("usb: isp1760: Add device controller support")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>

---
Compile-tested with Clang, W=1. No hardware runtime testing.

Based on mainline 0fcb05b72344f40806cbe810de8872f1698bf053.

diff --git a/drivers/usb/isp1760/isp1760-udc.c b/drivers/usb/isp1760/isp1760-udc.c
index e45a54c..7b60bd9 100644
--- a/drivers/usb/isp1760/isp1760-udc.c
+++ b/drivers/usb/isp1760/isp1760-udc.c
@@ -1581,6 +1581,7 @@ int isp1760_udc_register(struct isp1760_device *isp, int irq,
 error:
 	if (udc->irq >= 0)
 		free_irq(udc->irq, udc);
+	timer_shutdown_sync(&udc->vbus_timer);
 	kfree(udc->irqname);
 
 	return ret;
@@ -1593,6 +1594,9 @@ void isp1760_udc_unregister(struct isp1760_device *isp)
 	if (!udc->isp)
 		return;
 
+	/* The IRQ handler can rearm the timer until free_irq() below. */
+	timer_shutdown_sync(&udc->vbus_timer);
+
 	usb_del_gadget_udc(&udc->gadget);
 
 	free_irq(udc->irq, udc);