From 5eab1e7f7ed12893f3864fe46ffcd5a41a752d6a Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Fri, 23 Oct 2026 21:40:44 -0400 Subject: [PATCH] hwmon: (sht15) Stop deferred work before releasing its resources The IRQ handler and regulator notifier can leave work pending after a measurement or notification completes. Neither work item is drained before its resources are released on removal or probe failure. Disable read_work before freeing the IRQ, since the worker can re-enable it. Use request_irq()/free_irq() for explicit teardown. Unregister the regulator notifier before cancelling update_supply_work and disabling the regulator. Apply the same ordering to probe failures. Fixes: 251eb40f5ccd ("hwmon: sht15 humidity sensor driver") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Link: https://patch.msgid.link/20261024014044.27853-1-mhun512@gmail.com [groeck: Dropped obsolete 'Assisted-by: tag] Signed-off-by: Guenter Roeck --- drivers/hwmon/sht15.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c index 7bb2105d1ae2..48d93c61345c 100644 --- a/drivers/hwmon/sht15.c +++ b/drivers/hwmon/sht15.c @@ -31,6 +31,7 @@ #include #include #include +#include /* Commands */ #define SHT15_MEASURE_TEMP 0x03 @@ -976,25 +977,22 @@ static int sht15_probe(struct platform_device *pdev) goto err_release_reg; } - ret = devm_request_irq(&pdev->dev, gpiod_to_irq(data->data), - sht15_interrupt_fired, - IRQF_TRIGGER_FALLING, - "sht15 data", - data); + ret = request_irq(gpiod_to_irq(data->data), sht15_interrupt_fired, + IRQF_TRIGGER_FALLING, "sht15 data", data); if (ret) goto err_release_reg; disable_irq_nosync(gpiod_to_irq(data->data)); ret = sht15_connection_reset(data); if (ret) - goto err_release_reg; + goto err_free_irq; ret = sht15_soft_reset(data); if (ret) - goto err_release_reg; + goto err_free_irq; ret = sysfs_create_group(&pdev->dev.kobj, &sht15_attr_group); if (ret) { dev_err(&pdev->dev, "sysfs create failed\n"); - goto err_release_reg; + goto err_free_irq; } data->hwmon_dev = hwmon_device_register(data->dev); @@ -1007,9 +1005,13 @@ static int sht15_probe(struct platform_device *pdev) err_release_sysfs_group: sysfs_remove_group(&pdev->dev.kobj, &sht15_attr_group); +err_free_irq: + disable_work_sync(&data->read_work); + free_irq(gpiod_to_irq(data->data), data); err_release_reg: if (!IS_ERR(data->reg)) { regulator_unregister_notifier(data->reg, &data->nb); + cancel_work_sync(&data->update_supply_work); regulator_disable(data->reg); } return ret; @@ -1023,12 +1025,16 @@ static void sht15_remove(struct platform_device *pdev) hwmon_device_unregister(data->hwmon_dev); sysfs_remove_group(&pdev->dev.kobj, &sht15_attr_group); + disable_work_sync(&data->read_work); + free_irq(gpiod_to_irq(data->data), data); + ret = sht15_soft_reset(data); if (ret) dev_err(&pdev->dev, "Failed to reset device (%pe)\n", ERR_PTR(ret)); if (!IS_ERR(data->reg)) { regulator_unregister_notifier(data->reg, &data->nb); + cancel_work_sync(&data->update_supply_work); regulator_disable(data->reg); } }