The IRQ is devm-managed, so it can still queue plat->work while
remove() is tearing the queue down. Disable it first.

Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support")
Cc: stable@vger.kernel.org
Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>
---
v3:
- add Cc: stable (Heikki)

v2:
- keep the minimal remove() race fix; drop the workqueue later if wanted
  (code unchanged from v1)

 drivers/usb/typec/anx7411.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/anx7411.c b/drivers/usb/typec/anx7411.c
index 41df115912b9..c3d36da692e4 100644
--- a/drivers/usb/typec/anx7411.c
+++ b/drivers/usb/typec/anx7411.c
@@ -1566,8 +1566,11 @@ static void anx7411_i2c_remove(struct i2c_client *client)
 	anx7411_partner_unregister_altmode(plat);
 	anx7411_unregister_partner(plat);
 
-	if (plat->workqueue)
+	if (plat->workqueue) {
+		disable_irq(plat->intp_irq);
+		cancel_work_sync(&plat->work);
 		destroy_workqueue(plat->workqueue);
+	}
 
 	i2c_unregister_device(plat->spi_client);
 
-- 
2.25.1

On Thu, Sep 10, 2026 at 09:11:50AM +0800, Linkai Gong wrote:
> The IRQ is devm-managed, so it can still queue plat->work while
> remove() is tearing the queue down. Disable it first.
> 
> Fixes: fe6d8a9c8e64 ("usb: typec: anx7411: Add Analogix PD ANX7411 support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
> v3:
> - add Cc: stable (Heikki)
> 
> v2:
> - keep the minimal remove() race fix; drop the workqueue later if wanted
>   (code unchanged from v1)
> 
>  drivers/usb/typec/anx7411.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/anx7411.c b/drivers/usb/typec/anx7411.c
> index 41df115912b9..c3d36da692e4 100644
> --- a/drivers/usb/typec/anx7411.c
> +++ b/drivers/usb/typec/anx7411.c
> @@ -1566,8 +1566,11 @@ static void anx7411_i2c_remove(struct i2c_client *client)
>  	anx7411_partner_unregister_altmode(plat);
>  	anx7411_unregister_partner(plat);
>  
> -	if (plat->workqueue)
> +	if (plat->workqueue) {
> +		disable_irq(plat->intp_irq);
> +		cancel_work_sync(&plat->work);
>  		destroy_workqueue(plat->workqueue);
> +	}
>  
>  	i2c_unregister_device(plat->spi_client);
>  
> -- 
> 2.25.1

-- 
heikki