Re: [PATCH v1] mtd: rawnand: r852: Prevent card work during removal

[Miquel Raynal]

On 15/09/2026 at 22:45:43 +08, Yibo Tan <lhfff@xxxxxxxxxx> wrote:

> r852_irq() queues card_detect_work when card state changes.  r852_remove()
> currently cancels that work and destroys its private workqueue before it
> disables and frees the IRQ.
>
> A card event in this interval can queue delayed work on the destroyed
> workqueue.  Its timer is part of struct r852_device, which is freed later
> in r852_remove().  KASAN reported a use-after-free in the timer code when
> the card interrupt occurred in this interval.  The same test completed
> without a kernel diagnostic after this change.
>
> Set a removal flag while holding irqlock before cancelling the work.  The
> IRQ handler still acknowledges and disables card events, but does not
> queue more card-detect work during removal.  The lock ensures that work
> queued before the flag is cancelled and later interrupts skip the
> queue.

Why don't you just disable the IRQs? There is a helper for that.

Thanks,
Miquèl