With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before
charlcd_register() calls misc_register(). If registration fails, the
caller frees the charlcd object while delayed work still contains its
address.

Add charlcd_deinit() to cancel the delayed work and turn the backlight
off. Use it for both registration rollback and normal unregistration.

Fixes: 39f8ea46724e ("auxdisplay: charlcd: Extract character LCD core from misc/panel")
Cc: stable@vger.kernel.org
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
Changes in v3:
- Add Cc: stable@vger.kernel.org (Miguel).

Changes in v2:
- Factor the backlight cleanup into charlcd_deinit() and reuse it from
  charlcd_unregister() (Andy, Geert).
- Add the Fixes tag (Andy).

 drivers/auxdisplay/charlcd.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c
index 09020bb8ad15..ae2692ec3963 100644
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -595,6 +595,16 @@ static int charlcd_init(struct charlcd *lcd)
 	return 0;
 }
 
+static void charlcd_deinit(struct charlcd *lcd)
+{
+	struct charlcd_priv *priv = charlcd_to_priv(lcd);
+
+	if (lcd->ops->backlight) {
+		cancel_delayed_work_sync(&priv->bl_work);
+		lcd->ops->backlight(lcd, CHARLCD_OFF);
+	}
+}
+
 struct charlcd *charlcd_alloc(unsigned int drvdata_size)
 {
 	struct charlcd_priv *priv;
@@ -654,8 +664,10 @@ int charlcd_register(struct charlcd *lcd)
 		return ret;
 
 	ret = misc_register(&charlcd_dev);
-	if (ret)
+	if (ret) {
+		charlcd_deinit(lcd);
 		return ret;
+	}
 
 	the_charlcd = lcd;
 	register_reboot_notifier(&panel_notifier);
@@ -665,16 +677,11 @@ EXPORT_SYMBOL_GPL(charlcd_register);
 
 int charlcd_unregister(struct charlcd *lcd)
 {
-	struct charlcd_priv *priv = charlcd_to_priv(lcd);
-
 	unregister_reboot_notifier(&panel_notifier);
 	charlcd_puts(lcd, "\x0cLCD driver unloaded.\x1b[Lc\x1b[Lb\x1b[L-");
 	misc_deregister(&charlcd_dev);
 	the_charlcd = NULL;
-	if (lcd->ops->backlight) {
-		cancel_delayed_work_sync(&priv->bl_work);
-		priv->lcd.ops->backlight(&priv->lcd, CHARLCD_OFF);
-	}
+	charlcd_deinit(lcd);
 
 	return 0;
 }
-- 
2.50.1.windows.1

On Sat, Aug 15, 2026 at 06:59:50PM +0800, Hongyan Xu wrote:
> With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before
> charlcd_register() calls misc_register(). If registration fails, the
> caller frees the charlcd object while delayed work still contains its
> address.
> 
> Add charlcd_deinit() to cancel the delayed work and turn the backlight
> off. Use it for both registration rollback and normal unregistration.

Pushed to my review and testing queue, thanks!

-- 
With Best Regards,
Andy Shevchenko

On Sat, 15 Aug 2026 at 13:00, Hongyan Xu <getshell@seu.edu.cn> wrote:
> With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before
> charlcd_register() calls misc_register(). If registration fails, the
> caller frees the charlcd object while delayed work still contains its
> address.
>
> Add charlcd_deinit() to cancel the delayed work and turn the backlight
> off. Use it for both registration rollback and normal unregistration.
>
> Fixes: 39f8ea46724e ("auxdisplay: charlcd: Extract character LCD core from misc/panel")
> Cc: stable@vger.kernel.org
> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
> Changes in v3:
> - Add Cc: stable@vger.kernel.org (Miguel).
>
> Changes in v2:
> - Factor the backlight cleanup into charlcd_deinit() and reuse it from
>   charlcd_unregister() (Andy, Geert).
> - Add the Fixes tag (Andy).

Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

On Sat, Aug 15, 2026 at 1:00 PM Hongyan Xu <getshell@seu.edu.cn> wrote:
>
> Changes in v3:
> - Add Cc: stable@vger.kernel.org (Miguel).

Thanks! (Usually it is not needed to send a new version just to add a
tag -- it can be added by maintainers on apply)

Cheers,
Miguel