From nobody Fri Oct 2 11:43:21 2026 Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [40.65.178.148]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 390613E3D95; Sat, 1 Aug 2026 05:21:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=40.65.178.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785561670; cv=none; b=te9fGpLj7OE8ikzM5ufazXaUxBXxXxrPTulNgsmwAgsQoBzrI3V4/8Ns+paQXaTv+yHAub0gW1LjwmbPvhF/Ho/o6HytcCnl0OizKVgXfxWwidSkQ4u1nVNa9ysu51tTX1/iftH6YDiAXSg/hOVWbL6Kr0izqzCaPFUNYMuX9NU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785561670; c=relaxed/simple; bh=WNUg3ubh+MAZvf392NsUDZOjVUOM4UhgnpZ4cXoEWPM=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=DwzIhPVZwYTDliAHRHBZi1eQAHgBaVdZIQ0ZB+hx1RiE05GTrp4JrxVYbthN87KdGCk0vgDBOOKPBDcAbZUM2gxRVozYy0I54J7NQm18Kf8FFDFkHm75DOQqZ2ujP0jKnKz1HIf/VEgAqEZlIYA7SuEbqvkj7Jb2mdzgzjnr1vw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=40.65.178.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [10.98.66.117]) by mtasvr (Coremail) with SMTP id _____wCnpCk_gm1qMy9WAA--.9108S3; Sat, 01 Aug 2026 13:21:03 +0800 (CST) Received: from localhost.localdomain (unknown [10.98.66.117]) by mail-app4 (Coremail) with SMTP id zi_KCgDnGDA_gm1qfCnIAg--.59189S2; Sat, 01 Aug 2026 13:21:03 +0800 (CST) From: Fan Wu To: linux-pm@vger.kernel.org Cc: sre@kernel.org, laurentiu.palcu@intel.com, krzk@kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Fan Wu Subject: [PATCH v2] power: supply: bq24257: fix use-after-free on remove Date: Sat, 1 Aug 2026 05:19:58 +0000 Message-Id: <20260801051958.354528-1-fanwu01@zju.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zi_KCgDnGDA_gm1qfCnIAg--.59189S2 X-CM-SenderInfo: qrstjiaswqq6lmxovvfxof0/ X-CM-DELIVERINFO: =?B?KCK3CAXKKxbFmtjJiESix3B1w3vZ3A9ovKVTomAyoQazvoRs/NHSP8GI2EvgeEEW7R sfnXz+g1OQfMo27QHy5TwQyZyBhf7uZTBsfU+v6wr8RAna+0eYuL7vGw1tjkMo4J1nfCo7 WkQsjHmB0Ktf7tgs0gHN5RPxYw6l01w8CbPzC/8w X-Coremail-Antispam: 1Uk129KBj93XoWxXw48JryUAr4kuw48tF4fZwc_yoW5WFyUpF Z5CFW5C3y8JFWjyFZ2v3WIvF1rJrn8Ar17CrWIqw1kAr15Jrs8tFyIgF4a9r9rJrZ3Za1S 9rsIqF95ZrW5AFXCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUU9Gb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc804V CY07AIYIkI8VC2zVCFFI0UMc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AK xVWUtVWrXwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48Icx kI7VAKI48JM4x0Y48IcxkI7VAKI48G6xCjnVAKz4kxMxAIw28IcxkI7VAKI48JMxC20s02 6xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_Jr I_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v2 6r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj4 0_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8 JrUvcSsGvfC2KfnxnUUI43ZEXa7IU8OB_UUUUUU== Content-Type: text/plain; charset="utf-8" The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove() returns. remove() cancels bq->iilimit_setup_work while the threaded handler can still fire; that handler reschedules the work and dereferences bq, so the work runs against freed memory once devm frees bq. Make the delayed work device-managed with devm_delayed_work_autocancel(), registered before the interrupt request. The devm cleanup then releases the interrupt first, so the handler can no longer reschedule the work, and cancels the work before bq is freed. The explicit cancel_delayed_work_sync() in remove() is no longer needed and is dropped. Found by static analysis. Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260731143554.334179-1-fanwu01@zju.edu.cn --- Changes in v2: use devm_delayed_work_autocancel() before the IRQ request and drop the explicit cancel from remove(), per Sebastian Reichel (v1 used devm= _free_irq). drivers/power/supply/bq24257_charger.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/power/supply/bq24257_charger.c b/drivers/power/supply/= bq24257_charger.c index 72f1bfea8d..54dd9d4ec3 100644 --- a/drivers/power/supply/bq24257_charger.c +++ b/drivers/power/supply/bq24257_charger.c @@ -18,6 +18,7 @@ #include #include #include +#include =20 #include #include @@ -1003,10 +1004,6 @@ static int bq24257_probe(struct i2c_client *client) if (bq->info->chip =3D=3D BQ24250) bq->iilimit_autoset_enable =3D false; =20 - if (bq->iilimit_autoset_enable) - INIT_DELAYED_WORK(&bq->iilimit_setup_work, - bq24257_iilimit_setup_work); - /* * The BQ24250 doesn't have a dedicated Power Good (PG) pin so let's * not probe for it and instead use a SW-based approach to determine @@ -1047,6 +1044,14 @@ static int bq24257_probe(struct i2c_client *client) return ret; } =20 + if (bq->iilimit_autoset_enable) { + ret =3D devm_delayed_work_autocancel(dev, + &bq->iilimit_setup_work, + bq24257_iilimit_setup_work); + if (ret) + return ret; + } + ret =3D devm_request_threaded_irq(dev, client->irq, NULL, bq24257_irq_handler_thread, IRQF_TRIGGER_FALLING | @@ -1064,9 +1069,6 @@ static void bq24257_remove(struct i2c_client *client) { struct bq24257_device *bq =3D i2c_get_clientdata(client); =20 - if (bq->iilimit_autoset_enable) - cancel_delayed_work_sync(&bq->iilimit_setup_work); - bq24257_field_write(bq, F_RESET, 1); /* reset to defaults */ } =20 --=20 2.34.1