ucs1002 has no remove callback, so unbind runs entirely through devm.
The alert IRQ handler queues the health_poll delayed work, and the work
reschedules itself while the chip reports a bad-health condition.  devm
frees the alert IRQ, which only synchronizes the handler; it does not
cancel the delayed work, which can then run after devm frees the driver
data and dereference it.

Register health_poll with devm_delayed_work_autocancel() before the
alert IRQ is requested.  devm then frees the IRQ before cancelling the
work, so the handler can no longer queue it and the work is cancelled
before the driver data is freed.

This issue was found by an in-house static analysis tool.

Fixes: 81196e2e57fc ("power: supply: ucs1002: fix some health status issues")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/power/supply/ucs1002_power.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/ucs1002_power.c b/drivers/power/supply/ucs1002_power.c
index 3f44cc9..ca58c21 100644
--- a/drivers/power/supply/ucs1002_power.c
+++ b/drivers/power/supply/ucs1002_power.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/kthread.h>
 #include <linux/device.h>
+#include <linux/devm-helpers.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_irq.h>
@@ -640,7 +641,10 @@ static int ucs1002_probe(struct i2c_client *client)
 	}
 
 	info->health = POWER_SUPPLY_HEALTH_GOOD;
-	INIT_DELAYED_WORK(&info->health_poll, ucs1002_health_poll);
+	ret = devm_delayed_work_autocancel(dev, &info->health_poll,
+					   ucs1002_health_poll);
+	if (ret)
+		return ret;
 
 	if (irq_a_det > 0) {
 		ret = devm_request_threaded_irq(dev, irq_a_det, NULL,
-- 
2.34.1

On Sun, 02 Aug 2026 05:12:49 +0000, Fan Wu wrote:
> ucs1002 has no remove callback, so unbind runs entirely through devm.
> The alert IRQ handler queues the health_poll delayed work, and the work
> reschedules itself while the chip reports a bad-health condition.  devm
> frees the alert IRQ, which only synchronizes the handler; it does not
> cancel the delayed work, which can then run after devm frees the driver
> data and dereference it.
> 
> [...]

Applied, thanks!

[1/1] power: supply: ucs1002: fix use-after-free on remove
      commit: 609af0ceeaefdfa42cd01dd060b20f2e41f9a232

Best regards,
-- 
Sebastian Reichel <sebastian.reichel@collabora.com>

Am Sonntag, dem 02.08.2026 um 05:12 +0000 schrieb Fan Wu:
> ucs1002 has no remove callback, so unbind runs entirely through devm.
> The alert IRQ handler queues the health_poll delayed work, and the work
> reschedules itself while the chip reports a bad-health condition.  devm
> frees the alert IRQ, which only synchronizes the handler; it does not
> cancel the delayed work, which can then run after devm frees the driver
> data and dereference it.
> 
> Register health_poll with devm_delayed_work_autocancel() before the
> alert IRQ is requested.  devm then frees the IRQ before cancelling the
> work, so the handler can no longer queue it and the work is cancelled
> before the driver data is freed.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: 81196e2e57fc ("power: supply: ucs1002: fix some health status issues")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Reviewed-by: Lucas Stach <l.stach@pengutronix.de>

> ---
>  drivers/power/supply/ucs1002_power.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/power/supply/ucs1002_power.c b/drivers/power/supply/ucs1002_power.c
> index 3f44cc9..ca58c21 100644
> --- a/drivers/power/supply/ucs1002_power.c
> +++ b/drivers/power/supply/ucs1002_power.c
> @@ -11,6 +11,7 @@
>  #include <linux/kernel.h>
>  #include <linux/kthread.h>
>  #include <linux/device.h>
> +#include <linux/devm-helpers.h>
>  #include <linux/module.h>
>  #include <linux/of.h>
>  #include <linux/of_irq.h>
> @@ -640,7 +641,10 @@ static int ucs1002_probe(struct i2c_client *client)
>  	}
>  
>  	info->health = POWER_SUPPLY_HEALTH_GOOD;
> -	INIT_DELAYED_WORK(&info->health_poll, ucs1002_health_poll);
> +	ret = devm_delayed_work_autocancel(dev, &info->health_poll,
> +					   ucs1002_health_poll);
> +	if (ret)
> +		return ret;
>  
>  	if (irq_a_det > 0) {
>  		ret = devm_request_threaded_irq(dev, irq_a_det, NULL,