[PATCH v2 2/2] usb: gadget: tegra-xudc: Disable reset delayed works

[Myeonghun Pak]

The devm port-status IRQ stays registered through remove() and can
queue port_reset_war_work and plc_reset_work after
cancel_delayed_work_sync() returns.  remove() never stops the first.

disable_delayed_work_sync() drains both and rejects a later queue.
usb_role_sw_work stays on cancel_work_sync().  The PHY notifier is its
producer and is unregistered before this cancel.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller")
Cc: stable@xxxxxxxxxxxxxxx # 6.10+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
---
Changes in v2:
- Keep the Fixes tag on one line. (Thierry Reding)
- Disable plc_reset_work too.  The port-status IRQ can requeue it.
  (Thierry Reding)

 drivers/usb/gadget/udc/tegra-xudc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c
index a0585a1f19f0..dd0a033b4a7f 100644
--- a/drivers/usb/gadget/udc/tegra-xudc.c
+++ b/drivers/usb/gadget/udc/tegra-xudc.c
@@ -3932,7 +3932,8 @@ static void tegra_xudc_remove(struct platform_device *pdev)
 						&xudc->vbus_nb);
 	}
 
-	cancel_delayed_work_sync(&xudc->plc_reset_work);
+	disable_delayed_work_sync(&xudc->port_reset_war_work);
+	disable_delayed_work_sync(&xudc->plc_reset_work);
 	cancel_work_sync(&xudc->usb_role_sw_work);
 
 	usb_del_gadget_udc(&xudc->gadget);
-- 
2.53.0