[PATCH] power: supply: sc2731_charger: cancel work on remove

[PATCH] power: supply: sc2731_charger: cancel work on remove

[Hongyan Xu]

The USB notifier and initial charger detection can schedule info->work.
The remove path unregisters the notifier, but does not cancel queued or
running work before the devm-allocated driver data is released.

Set the platform drvdata used by remove, then cancel the work after
unregistering the notifier.

This issue was found by a static analysis tool.

Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/power/supply/sc2731_charger.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/power/supply/sc2731_charger.c b/drivers/power/supply/sc2731_charger.c
index 58b86fd78..2b25e44da 100644
--- a/drivers/power/supply/sc2731_charger.c
+++ b/drivers/power/supply/sc2731_charger.c
@@ -466,6 +466,7 @@ static int sc2731_charger_probe(struct platform_device *pdev)
 	mutex_init(&info->lock);
 	info->dev = &pdev->dev;
 	INIT_WORK(&info->work, sc2731_charger_work);
+	platform_set_drvdata(pdev, info);
 
 	info->regmap = dev_get_regmap(pdev->dev.parent, NULL);
 	if (!info->regmap) {
@@ -516,6 +517,7 @@ static void sc2731_charger_remove(struct platform_device *pdev)
 	struct sc2731_charger_info *info = platform_get_drvdata(pdev);
 
 	usb_unregister_notifier(info->usb_phy, &info->usb_notify);
+	cancel_work_sync(&info->work);
 }
 
 static const struct of_device_id sc2731_charger_of_match[] = {
-- 
2.50.1.windows.1

Re: [PATCH] power: supply: sc2731_charger: cancel work on remove

[Baolin Wang]

On 7/28/26 8:33 PM, Hongyan Xu wrote:
> The USB notifier and initial charger detection can schedule info->work.
> The remove path unregisters the notifier, but does not cancel queued or
> running work before the devm-allocated driver data is released.
> 
> Set the platform drvdata used by remove, then cancel the work after
> unregistering the notifier.
> 
> This issue was found by a static analysis tool.
> 
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---

Good catch. Please also add a Fixes tag, with that:
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>

>   drivers/power/supply/sc2731_charger.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/power/supply/sc2731_charger.c b/drivers/power/supply/sc2731_charger.c
> index 58b86fd78..2b25e44da 100644
> --- a/drivers/power/supply/sc2731_charger.c
> +++ b/drivers/power/supply/sc2731_charger.c
> @@ -466,6 +466,7 @@ static int sc2731_charger_probe(struct platform_device *pdev)
>   	mutex_init(&info->lock);
>   	info->dev = &pdev->dev;
>   	INIT_WORK(&info->work, sc2731_charger_work);
> +	platform_set_drvdata(pdev, info);
>   
>   	info->regmap = dev_get_regmap(pdev->dev.parent, NULL);
>   	if (!info->regmap) {
> @@ -516,6 +517,7 @@ static void sc2731_charger_remove(struct platform_device *pdev)
>   	struct sc2731_charger_info *info = platform_get_drvdata(pdev);
>   
>   	usb_unregister_notifier(info->usb_phy, &info->usb_notify);
> +	cancel_work_sync(&info->work);
>   }
>   
>   static const struct of_device_id sc2731_charger_of_match[] = {