Commit 7fc3e254 authored by Jian Zhang's avatar Jian Zhang Committed by Corey Minyard
Browse files

ipmi: ssif_bmc: cancel response timer on remove 



The response timer can stay armed across device teardown. If it fires after
remove, the callback dereferences the SSIF context and the i2c client after
teardown has started.

Cancel the timer in remove so the callback cannot run after the device is
unregistered.

Signed-off-by: default avatarJian Zhang <zhangjian.3032@bytedance.com>
Message-ID: <20260403090603.3988423-1-zhangjian.3032@bytedance.com>
Signed-off-by: default avatarCorey Minyard <corey@minyard.net>
parent 122d16da

drivers/char/ipmi/ssif_bmc.c

+1 −0
Original line number Diff line number Diff line
@@ -843,6 +843,7 @@ static void ssif_bmc_remove(struct i2c_client *client) 
{

	struct ssif_bmc_ctx *ssif_bmc = i2c_get_clientdata(client);



	timer_delete_sync(&ssif_bmc->response_timer);

	i2c_slave_unregister(client);

	misc_deregister(&ssif_bmc->miscdev);

}