In the Linux kernel, the following vulnerability has been resolved:

iio: light: gp2ap020a00f: drain irq work after free irq

The threaded IRQ handler queues data->work through irq work queue() so the trigger is polled from a per-CPU context. free irq() does not flush an irq work the handler already queued, so after gp2ap020a00f remove() returns that work may still run and call iio trigger poll() on data->trig, which the devm cleanup has already freed, causing a use-after-free.

Add irq work sync(&data->work) after free irq() in remove() and in the probe error path, mirroring commit 78601726d4a5 ("iio: trigger: sysfs: fix use-after-free on remove").

Found by an in-house static analysis tool, confirmed by manual review.