From 7fc3e2546cf3fa9a28a2acc92a512c779a8e5038 Mon Sep 17 00:00:00 2001 From: Jian Zhang Date: Fri, 3 Apr 2026 17:05:58 +0800 Subject: [PATCH] ipmi: ssif_bmc: cancel response timer on remove The response timer can stay armed across device teardown. If it fires after remove, the callback dereferences the SSIF context and the i2c client after teardown has started. Cancel the timer in remove so the callback cannot run after the device is unregistered. Signed-off-by: Jian Zhang Message-ID: <20260403090603.3988423-1-zhangjian.3032@bytedance.com> Signed-off-by: Corey Minyard --- drivers/char/ipmi/ssif_bmc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c index 7a52e3ea49ed8..dc1d5bb4a4604 100644 --- a/drivers/char/ipmi/ssif_bmc.c +++ b/drivers/char/ipmi/ssif_bmc.c @@ -843,6 +843,7 @@ static void ssif_bmc_remove(struct i2c_client *client) { struct ssif_bmc_ctx *ssif_bmc = i2c_get_clientdata(client); + timer_delete_sync(&ssif_bmc->response_timer); i2c_slave_unregister(client); misc_deregister(&ssif_bmc->miscdev); } -- 2.47.3