From nobody Fri Oct 2 11:43:31 2026 Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [52.237.72.81]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 2E94E311973; Sat, 1 Aug 2026 05:20:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=52.237.72.81 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785561636; cv=none; b=BiNLzKnRGcK7l3xC4LAKLsj/YAKUXU1ubi3OebQLs1VBsX//ML2Hws5LacQNZhOyJde2YgbXNk/d+BDf0a3iJutFX/TeYo4JeZJafQBx+E1zosIHdi1OLI3/BsYvzVINvuCVlMUffCkw5J1Jss6Czol6kvyVqOkKhaF6lKx/O3w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785561636; c=relaxed/simple; bh=4Tlvi5UYJN51NXV72K6rCXjI5MMkNbKhxtJoePupy3I=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=XttMMLZLurWseyczVJMig6Lp0emMGeZylYxUu9Q2m58nFqApFzTPzH/z1z3VL/QzoibraILjktzI2U9xF0bVvJaKMbzBIcY7EFgR2FHS/J/ah7c2J08hXEyOWehEE2xJo5wR7w94adzVfLMPL5Y4Ij+cDmxInUS+zO41m8usMAk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=52.237.72.81 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [10.98.66.117]) by mtasvr (Coremail) with SMTP id _____wCnvnwWgm1q0i5WAA--.6654S3; Sat, 01 Aug 2026 13:20:22 +0800 (CST) Received: from localhost.localdomain (unknown [10.98.66.117]) by mail-app4 (Coremail) with SMTP id zi_KCgDnGDAUgm1qcSjIAg--.59186S2; Sat, 01 Aug 2026 13:20:20 +0800 (CST) From: Fan Wu To: linux-pm@vger.kernel.org Cc: sre@kernel.org, andersson@kernel.org, neil.armstrong@linaro.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Fan Wu Subject: [PATCH v2] power: supply: qcom_battmgr: fix use-after-free Date: Sat, 1 Aug 2026 05:19:23 +0000 Message-Id: <20260801051923.354496-1-fanwu01@zju.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zi_KCgDnGDAUgm1qcSjIAg--.59186S2 X-CM-SenderInfo: qrstjiaswqq6lmxovvfxof0/ X-CM-DELIVERINFO: =?B?8vDrNQXKKxbFmtjJiESix3B1w3vZ3A9ovKVTomAyoQazvoRs/NHSP8GI2EvgeEEW7R sfnXz+g1OQfMo27QHy5TwQyZw0Aeoo/v04+NDk9dg9HEkc92Gs9tPYr9gK0nU40KQM5tkR 7l7v5J6jiZR2qpCeqdCp9E6mavGmQbzmcFsnzP86 X-Coremail-Antispam: 1Uk129KBj93XoW7Zw4kKF17Jr47Gw18Gw1fZrc_yoW5JFyfpa n5KFsI9rWUZF13Ja4qy3W7AryfW3yqkFy7GFy2g348Zry3trnaqFy5tF1Ygr9xJrZFya1j v39Iqr9xWF13AwbCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUU9lb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc804V CY07AIYIkI8VC2zVCFFI0UMc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AK xVWUAVWUtwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48Icx kI7VAKI48JM4x0Y48IcxkI7VAKI48G6xCjnVAKz4kxMxAIw28IcxkI7VAKI48JMxC20s02 6xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_Jr I_JrWlx4CE17CEb7AF67AKxVWUtVW8ZwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v2 6r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVWUJVW8JwCI42IY6xAIw20EY4v20xvaj4 0_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVWUJVW8 JbIYCTnIWIevJa73UjIFyTuYvjxU7ID7DUUUU Content-Type: text/plain; charset="utf-8" qcom_battmgr_pdr_notify() queues enable_work when the PMIC GLINK service comes up, and the worker recovers battmgr through container_of() to issue firmware requests. The PMIC GLINK client stays on the client list until its devres release action runs, so a PDR notification can keep queueing the work, and a pending or running worker can access battmgr after devres frees it. Make enable_work device-managed with devm_work_autocancel(), registered before the PMIC GLINK client is allocated. The devres cleanup then releases the client first, so no further notification can queue the work, and cancels the work before battmgr is freed. This issue was found by an in-house static analysis tool. Fixes: 29e8142b5623 ("power: supply: Introduce Qualcomm PMIC GLINK power su= pply") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260731022006.317192-1-fanwu01@zju.edu.cn --- Changes in v2: use devm_work_autocancel() instead of a manual remove() callback with disable_work_sync(), per Sebastian Reichel. drivers/power/supply/qcom_battmgr.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/power/supply/qcom_battmgr.c b/drivers/power/supply/qco= m_battmgr.c index 490137a23d..362ad58068 100644 --- a/drivers/power/supply/qcom_battmgr.c +++ b/drivers/power/supply/qcom_battmgr.c @@ -5,6 +5,7 @@ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include +#include #include #include #include @@ -1648,7 +1649,6 @@ static int qcom_battmgr_probe(struct auxiliary_device= *adev, psy_cfg_supply.supplied_to =3D qcom_battmgr_battery; psy_cfg_supply.num_supplicants =3D 1; =20 - INIT_WORK(&battmgr->enable_work, qcom_battmgr_enable_worker); mutex_init(&battmgr->lock); init_completion(&battmgr->ack); =20 @@ -1711,6 +1711,11 @@ static int qcom_battmgr_probe(struct auxiliary_devic= e *adev, "failed to register wireless charing power supply\n"); } =20 + ret =3D devm_work_autocancel(dev, &battmgr->enable_work, + qcom_battmgr_enable_worker); + if (ret) + return ret; + battmgr->client =3D devm_pmic_glink_client_alloc(dev, PMIC_GLINK_OWNER_BA= TTMGR, qcom_battmgr_callback, qcom_battmgr_pdr_notify, --=20 2.34.1