tegra_hte_test_remove() releases GPIO descriptors before stopping
hte.timer. gpio_timer_cb() accesses hte.gpio_out and rearms the timer, so
a callback concurrent with remove can use a released descriptor and rearm
after teardown.

Shut down the timer before releasing the GPIO descriptors.
timer_shutdown_sync() waits for a running callback and prevents it from
being rearmed.

Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/hte/hte-tegra194-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c
index 32907d951..cca33868f 100644
--- a/drivers/hte/hte-tegra194-test.c
+++ b/drivers/hte/hte-tegra194-test.c
@@ -217,10 +217,10 @@ static void tegra_hte_test_remove(struct platform_device *pdev)
 {
 	(void)pdev;
 
+	timer_shutdown_sync(&hte.timer);
 	free_irq(hte.gpio_in_irq, &hte);
 	gpiod_put(hte.gpio_in);
 	gpiod_put(hte.gpio_out);
-	timer_delete_sync(&hte.timer);
 }
 
 static struct platform_driver tegra_hte_test_driver = {
-- 
2.34.1

On 9/3/26 11:11 PM, Runyu Xiao wrote:
> tegra_hte_test_remove() releases GPIO descriptors before stopping
> hte.timer. gpio_timer_cb() accesses hte.gpio_out and rearms the timer, so
> a callback concurrent with remove can use a released descriptor and rearm
> after teardown.
> 
> Shut down the timer before releasing the GPIO descriptors.
> timer_shutdown_sync() waits for a running callback and prevents it from
> being rearmed.
> 
> Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:GPT-5
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  drivers/hte/hte-tegra194-test.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/hte/hte-tegra194-test.c b/drivers/hte/hte-tegra194-test.c
> index 32907d951..cca33868f 100644
> --- a/drivers/hte/hte-tegra194-test.c
> +++ b/drivers/hte/hte-tegra194-test.c
> @@ -217,10 +217,10 @@ static void tegra_hte_test_remove(struct platform_device *pdev)
>  {
>  	(void)pdev;
>  
> +	timer_shutdown_sync(&hte.timer);
>  	free_irq(hte.gpio_in_irq, &hte);
>  	gpiod_put(hte.gpio_in);
>  	gpiod_put(hte.gpio_out);
> -	timer_delete_sync(&hte.timer);
>  }
>  
>  static struct platform_driver tegra_hte_test_driver = {
Acked-by: Dipen Patel <dipenp@nvidia.com>