The probe and alternate mode callbacks can schedule tbt->work. The remove
callback drops the cable and plug references without canceling that work,
and the devres core then frees tbt. A pending or running work item can
therefore dereference both released objects and the freed tbt allocation.

Cancel the work synchronously before dropping the referenced Type-C
objects.

Fixes: 100e25738659 ("usb: typec: Add driver for Thunderbolt 3 Alternate Mode")
Cc: stable@vger.kernel.org
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/usb/typec/altmodes/thunderbolt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/typec/altmodes/thunderbolt.c b/drivers/usb/typec/altmodes/thunderbolt.c
index 32250b94262a..57c8dff0c51f 100644
--- a/drivers/usb/typec/altmodes/thunderbolt.c
+++ b/drivers/usb/typec/altmodes/thunderbolt.c
@@ -303,6 +303,8 @@ static void tbt_altmode_remove(struct typec_altmode *alt)
 {
 	struct tbt_altmode *tbt = typec_altmode_get_drvdata(alt);
 
+	cancel_work_sync(&tbt->work);
+
 	for (int i = TYPEC_PLUG_SOP_PP; i >= 0; --i) {
 		if (tbt->plug[i])
 			typec_altmode_put_plug(tbt->plug[i]);
-- 
2.50.1.windows.1

On Thu, Aug 06, 2026 at 02:07:12PM +0800, Hongyan Xu wrote:
> The probe and alternate mode callbacks can schedule tbt->work. The remove
> callback drops the cable and plug references without canceling that work,
> and the devres core then frees tbt. A pending or running work item can
> therefore dereference both released objects and the freed tbt allocation.
> 
> Cancel the work synchronously before dropping the referenced Type-C
> objects.
> 
> Fixes: 100e25738659 ("usb: typec: Add driver for Thunderbolt 3 Alternate Mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
>  drivers/usb/typec/altmodes/thunderbolt.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/typec/altmodes/thunderbolt.c b/drivers/usb/typec/altmodes/thunderbolt.c
> index 32250b94262a..57c8dff0c51f 100644
> --- a/drivers/usb/typec/altmodes/thunderbolt.c
> +++ b/drivers/usb/typec/altmodes/thunderbolt.c
> @@ -303,6 +303,8 @@ static void tbt_altmode_remove(struct typec_altmode *alt)
>  {
>  	struct tbt_altmode *tbt = typec_altmode_get_drvdata(alt);
>  
> +	cancel_work_sync(&tbt->work);

There's already a fix for this one:
https://lore.kernel.org/linux-usb/20260802014959.416687-1-fanwu01@zju.edu.cn/

thanks,

-- 
heikki