Re: [PATCH] usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop

On 19/08/2026 17:19, Fan Wu wrote:
> cc_debounce_dwork lives on the system workqueue but is armed from
> tcpm callbacks (set_cc/start_toggling).  Those callbacks run on tcpm's
> kthread worker which is only destroyed by tcpm_unregister_port(), after
> port_stop() has already returned, opening a potential race window where
> tcpm's worker flush re-arms the work.
> 
> Use disable_delayed_work_sync() in port_stop() to cancel any pending
> instance and prevent future schedule_delayed_work() calls from
> succeeding.  Also unwind a failed port_start() through port_stop(),
> which otherwise jumps straight to tcpm_unregister_port() and leaves
> the same window open after a failed probe.

I'd prefer to see two patches broken at the "also" in the above statement.

> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
> Cc: [email protected] # v6.10+
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <[email protected]>
> ---
>   drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c      | 3 +--
>   drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 2 ++
>   2 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
> index 35320f89d..f42c9e65f 100644
> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c
> @@ -101,7 +101,7 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)
>   
>   	ret = tcpm->port_start(tcpm, tcpm->tcpm_port);
>   	if (ret)
> -		goto port_unregister;
> +		goto port_stop;
>   
>   	ret = tcpm->pdphy_start(tcpm, tcpm->tcpm_port);
>   	if (ret)
> @@ -117,7 +117,6 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)
>   	tcpm->pdphy_stop(tcpm);
>   port_stop:
>   	tcpm->port_stop(tcpm);
> -port_unregister:
>   	tcpm_unregister_port(tcpm->tcpm_port);
>   fwnode_remove:
>   	fwnode_handle_put(tcpm->tcpc.fwnode);
> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> index 429bd42a0..fdc379fc4 100644
> --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
> @@ -694,6 +694,8 @@ static void qcom_pmic_typec_port_stop(struct pmic_typec *tcpm)
>   
>   	for (i = 0; i < pmic_typec_port->nr_irqs; i++)
>   		disable_irq(pmic_typec_port->irq_data[i].irq);
> +
> +	disable_delayed_work_sync(&pmic_typec_port->cc_debounce_dwork);
>   }
>   
>   int qcom_pmic_typec_port_probe(struct platform_device *pdev,
>