[PATCH] platform/chrome: cros_ec_debugfs: unregister panic notifier on remove

cros_ec_debugfs_probe() registers a panic notifier whose callback
recovers struct cros_ec_debugfs with container_of() and can schedule or
flush the console log work.

cros_ec_debugfs_remove() removes debugfs state and cleans up the console
log buffer, but it leaves the notifier registered.  A later panic
notification can therefore call back into freed debugfs state.

Unregister the panic notifier before tearing down the debugfs and log
state.

Signed-off-by: Pengpeng Hou <[email protected]>
---
 drivers/platform/chrome/cros_ec_debugfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c
index d10f9561990c..a19de7d418fe 100644
--- a/drivers/platform/chrome/cros_ec_debugfs.c
+++ b/drivers/platform/chrome/cros_ec_debugfs.c
@@ -530,6 +530,8 @@ static void cros_ec_debugfs_remove(struct platform_device *pd)
 {
 	struct cros_ec_dev *ec = dev_get_drvdata(pd->dev.parent);
 
+	blocking_notifier_chain_unregister(&ec->ec_dev->panic_notifier,
+					   &ec->debug_info->notifier_panic);
 	debugfs_remove_recursive(ec->debug_info->dir);
 	cros_ec_cleanup_console_log(ec->debug_info);
 }
-- 
2.50.1 (Apple Git-155)