From nobody Sat Jun 13 04:51:16 2026 Received: from mta.al2klimov.de (mta.al2klimov.de [162.55.223.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6B7A2D77E5 for ; Sun, 10 May 2026 19:18:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.55.223.79 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778440738; cv=none; b=R8xcM0vHlC0urG3gG8NCuLYqlG6sy/1EKSVe5m8jHPs1m8bSdxeTPdCYMZaoau3Ccuz2l+6Rii/+MaoS3WK1AjzpcrJqFMDGsPeJFlcqyf4pYg1pwz20+YtX3SbwizMTFE3o/oPMExhstFpcAqRFTLarwXC8WSlH7nvuVxiK548= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778440738; c=relaxed/simple; bh=Lify9AusS/jUXyAjiDSiCkWtgEDrUQLoD5rugO8LV/Y=; h=Message-ID:Date:MIME-Version:To:Cc:From:Subject:Content-Type; b=TOTIKgvNAWb4YNERtWxQ2iLSf0S7rDLtDA1XxpW0qbVAwkKqiRcYwkqZle+i5zBZVn4NeAIyhCPTkr3RRMtM3HXZJVUmjOw4ghGDqqiOaQcKLCsHP2V+mSHxc2UQbK13/hEK/xLqCpgAbj4lKeG0pM0lXlkdJ3WVne8QvGEvHaI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=al2klimov.de; spf=pass smtp.mailfrom=al2klimov.de; dkim=pass (2048-bit key) header.d=al2klimov.de header.i=@al2klimov.de header.b=fYLufLoC; arc=none smtp.client-ip=162.55.223.79 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=al2klimov.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=al2klimov.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=al2klimov.de header.i=@al2klimov.de header.b="fYLufLoC" DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; s=default; bh=Lify9AusS/jU XyAjiDSiCkWtgEDrUQLoD5rugO8LV/Y=; h=subject:from:cc:to:date; d=al2klimov.de; b=fYLufLoCisWV015Lilzadmod9o7Y2udKX13JkFNQbrwqwpTvUIMD GhcNxPN1vYQ2wzRueYU7dIT6EwW7bmmSf4c++4Ngtm5tk8Xzj/9dkd0OfTPkItzSqAvvQK i63HkvyddkyQu/gpwnP3B1LfIM0Y0ldGhUpoKY92c++ZME6SN7HSNcOgNfCWZ5FyJWvR07 ky1Dbqr3XgCkRgq+i0YcX+4wbwczEoryTnzoVyctZnlFdqQamZ3SPM6sJusc4ERx9C0iuI N/hL8LQ//bYNP5Wqqskq47DF30M0VjW9xHiPnJAwGqllwe0zcAfVLtjtX8HwX24CgDPPzH 3EX/8nMWYw== Received: from [IPV6:2a02:2455:18e9:e011:4d8a:aad2:c25c:50e5] (2a02-2455-18e9-e011-4d8a-aad2-c25c-50e5.dyn6.pyur.net [2a02:2455:18e9:e011:4d8a:aad2:c25c:50e5]) by mta.al2klimov.de (OpenSMTPD) with ESMTPSA id 38bd7d96 (TLSv1.3:TLS_CHACHA20_POLY1305_SHA256:256:NO); Sun, 10 May 2026 18:52:13 +0000 (UTC) Message-ID: Date: Sun, 10 May 2026 18:06:46 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Andy Shevchenko Cc: Geert Uytterhoeven , Linux Kernel Mailing List From: "Alexander A. Klimov" Subject: [PATCH] Auxiliary display drivers: fix possible race condition Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; format="flowed" Before linedisp_unregister(), call disable_delayed_work_sync(), not just cancel_delayed_work_sync(). While cancel_delayed_work_sync() cancels queued work and awaits running work, it doesn't reject future work, such as scheduled by the timer which is set up in linedisp_register(). This timer may fire just before linedisp_unregister() stops it and cause kind of use after free. In contrast, disable_delayed_work_sync() also prevents future work. Signed-off-by: Alexander A. Klimov --- drivers/auxdisplay/max6959.c | 2 +- drivers/auxdisplay/seg-led-gpio.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/auxdisplay/max6959.c b/drivers/auxdisplay/max6959.c index 6bbc8d48fb..a123077945 100644 --- a/drivers/auxdisplay/max6959.c +++ b/drivers/auxdisplay/max6959.c @@ -148,7 +148,7 @@ static void max6959_i2c_remove(struct i2c_client *clien= t) { struct max6959_priv *priv =3D i2c_get_clientdata(client); - cancel_delayed_work_sync(&priv->work); + disable_delayed_work_sync(&priv->work); linedisp_unregister(&priv->linedisp); } diff --git a/drivers/auxdisplay/seg-led-gpio.c b/drivers/auxdisplay/seg-led= -gpio.c index dfb62e9ce9..83a2b3ff13 100644 --- a/drivers/auxdisplay/seg-led-gpio.c +++ b/drivers/auxdisplay/seg-led-gpio.c @@ -84,7 +84,7 @@ static void seg_led_remove(struct platform_device *pdev) { struct seg_led_priv *priv =3D platform_get_drvdata(pdev); - cancel_delayed_work_sync(&priv->work); + disable_delayed_work_sync(&priv->work); linedisp_unregister(&priv->linedisp); } --=20 2.54.0