On Thu, Apr 02, 2026 at 07:04:31PM +0800, Jian Zhang via Openipmi-developer
wrote:
> The response timer can stay armed across device teardown. If it fires after
> remove, the callback dereferences the SSIF context and the i2c client after
> teardown has started.
>
> Cancel the timer in remove so the callback cannot run after the device is
> unregistered.
This whole series looks good to me, and I have added it to my next tree.
I'd like to hear from Quan, though.
-corey
>
> Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver")
> Signed-off-by: Jian Zhang <[email protected]>
> ---
> drivers/char/ipmi/ssif_bmc.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c
> index 7a52e3ea49ed..348e29490945 100644
> --- a/drivers/char/ipmi/ssif_bmc.c
> +++ b/drivers/char/ipmi/ssif_bmc.c
> @@ -843,6 +843,7 @@ static void ssif_bmc_remove(struct i2c_client *client)
> {
> struct ssif_bmc_ctx *ssif_bmc = i2c_get_clientdata(client);
>
> + del_timer_sync(&ssif_bmc->response_timer);
> i2c_slave_unregister(client);
> misc_deregister(&ssif_bmc->miscdev);
> }
> --
> 2.20.1
>
>
> _______________________________________________
> Openipmi-developer mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/openipmi-developer
_______________________________________________
Openipmi-developer mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openipmi-developer
