[PATCH] Input: lm8323 - cancel PWM work before releasing device data

[PATCH] Input: lm8323 - cancel PWM work before releasing device data

[Hongyan Xu]

LED class device teardown sets the LED brightness to off. The LM8323
brightness callback responds by scheduling its private PWM work, while
LED core only flushes the class device's own work item.

Register a devm action before each LED class device. Devres teardown then
unregisters the LED first, cancels any resulting PWM work, and only then
releases the containing LM8323 data.

This issue was found by a static analysis tool.

Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/input/keyboard/lm8323.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/input/keyboard/lm8323.c b/drivers/input/keyboard/lm8323.c
index 7bee93e..1d799ce 100644
--- a/drivers/input/keyboard/lm8323.c
+++ b/drivers/input/keyboard/lm8323.c
@@ -552,6 +552,13 @@ static struct attribute *lm8323_pwm_attrs[] = {
 };
 ATTRIBUTE_GROUPS(lm8323_pwm);
 
+static void lm8323_cancel_pwm_work(void *data)
+{
+	struct lm8323_pwm *pwm = data;
+
+	cancel_work_sync(&pwm->work);
+}
+
 static int init_pwm(struct lm8323_chip *lm, int id, struct device *dev,
 		    const char *name)
 {
@@ -572,6 +579,10 @@ static int init_pwm(struct lm8323_chip *lm, int id, struct device *dev,
 	mutex_init(&pwm->lock);
 	pwm->chip = lm;
 
+	err = devm_add_action_or_reset(dev, lm8323_cancel_pwm_work, pwm);
+	if (err)
+		return err;
+
 	if (name) {
 		pwm->cdev.name = name;
 		pwm->cdev.brightness_set = lm8323_pwm_set_brightness;
-- 
2.50.1.windows.1