The HPD interrupt remains active until devres releases it after the
driver's remove callback returns. Its handler queues work that accesses
the Type-C port and DRM bridge, but remove unregisters those objects
before destroying the workqueue. An interrupt can therefore race with
teardown and queue work that accesses released objects.
Disable the interrupt first to synchronize with the handler, then destroy
the workqueue to drain work queued before the interrupt was disabled. This
ensures that no HPD work remains before unregistering its consumers.
Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
drivers/gpu/drm/bridge/analogix/anx7625.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
index fffcd6154..d6071839f 100644
--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
@@ -2973,13 +2973,15 @@ static void anx7625_i2c_remove(struct i2c_client *client)
{
struct anx7625_data *platform = i2c_get_clientdata(client);
+ if (platform->pdata.intp_irq) {
+ disable_irq(platform->pdata.intp_irq);
+ destroy_workqueue(platform->workqueue);
+ }
+
anx7625_typec_unregister(platform);
drm_bridge_remove(&platform->bridge);
- if (platform->pdata.intp_irq)
- destroy_workqueue(platform->workqueue);
-
if (platform->hdcp_workqueue) {
cancel_delayed_work(&platform->hdcp_work);
destroy_workqueue(platform->hdcp_workqueue);
--
2.47.1