From: Danish Khateeb <danishkhateeb03@gmail.com>
To: Lee Jones <lee@kernel.org>, Pavel Machek <pavel@kernel.org>
Cc: Andrew Davis <afd@ti.com>,
linux-leds@vger.kernel.org, linux-kernel@vger.kernel.org,
Danish Khateeb <danishkhateeb03@gmail.com>
Subject: [PATCH v3 2/2] leds: tca6507: Turn the LEDs off on unbind
Date: Wed, 28 Oct 2026 12:43:48 -0500 [thread overview]
Message-ID: <20261028174348.64014-3-danishkhateeb03@gmail.com> (raw)
In-Reply-To: <20261028174348.64014-1-danishkhateeb03@gmail.com>
Unregistering an LED that is on turns it off, and the driver does that
from its work, which is queued from led_assign(). On unbind the work is
then cancelled by devres, so if it has not run yet the LED stays on after
the driver is gone.
Flush the work instead of cancelling it. By the time the devres action
runs, the LEDs and the GPIO chip have been unregistered, and the work
does not queue itself, so nothing can queue it again.
Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
---
drivers/leds/leds-tca6507.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c
index 0f987e551f03..ffad476af625 100644
--- a/drivers/leds/leds-tca6507.c
+++ b/drivers/leds/leds-tca6507.c
@@ -71,7 +71,6 @@
* not recognised when matching.
*/
-#include <linux/devm-helpers.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/leds.h>
@@ -712,6 +711,11 @@ static const struct of_device_id __maybe_unused of_tca6507_leds_match[] = {
};
MODULE_DEVICE_TABLE(of, of_tca6507_leds_match);
+static void tca6507_flush_work(void *work)
+{
+ flush_work(work);
+}
+
static int tca6507_probe(struct i2c_client *client)
{
struct device *dev = &client->dev;
@@ -738,7 +742,8 @@ static int tca6507_probe(struct i2c_client *client)
tca->client = client;
spin_lock_init(&tca->lock);
- err = devm_work_autocancel(dev, &tca->work, tca6507_work);
+ INIT_WORK(&tca->work, tca6507_work);
+ err = devm_add_action_or_reset(dev, tca6507_flush_work, &tca->work);
if (err)
return err;
--
2.56.0
prev parent reply other threads:[~2026-10-28 17:43 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-28 17:43 [PATCH v3 0/2] leds: tca6507: Fix use-after-free on unbind and turn the LEDs off Danish Khateeb
2026-10-28 17:43 ` [PATCH v3 1/2] leds: tca6507: Fix use-after-free on unbind Danish Khateeb
2026-10-28 17:43 ` Danish Khateeb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261028174348.64014-3-danishkhateeb03@gmail.com \
--to=danishkhateeb03@gmail.com \
--cc=afd@ti.com \
--cc=lee@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-leds@vger.kernel.org \
--cc=pavel@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®