ipmi: ssif_bmc: cancel response timer on remove

The response timer can stay armed across device teardown. If it fires after
remove, the callback dereferences the SSIF context and the i2c client after
teardown has started.

Cancel the timer in remove so the callback cannot run after the device is
unregistered.

Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
Message-ID: <20260403090603.3988423-1-zhangjian.3032@bytedance.com>
Signed-off-by: Corey Minyard <corey@minyard.net>

diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c
index 7a52e3ea49ed8ba9fe0023c1cd390ead9e0c09c4..dc1d5bb4a460446a8e991f96acde01b6b05a7417 100644 (file)
--- a/drivers/char/ipmi/ssif_bmc.c
+++ b/drivers/char/ipmi/ssif_bmc.c
@@ -843,6 +843,7 @@ static void ssif_bmc_remove(struct i2c_client *client)
 {
        struct ssif_bmc_ctx *ssif_bmc = i2c_get_clientdata(client);
 
+       timer_delete_sync(&ssif_bmc->response_timer);
        i2c_slave_unregister(client);
        misc_deregister(&ssif_bmc->miscdev);
 }