Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `extcon` handle, means that the
`extcon` handle will be deallocated/unregistered _before_ the interrupt
handler (since `devm_` naturally deallocates in reverse allocation
order). This means that during removal, there is a race condition where
an interrupt can fire just _after_ the `extcon` handle has been
freed, *but* just _before_ the corresponding unregistration of the IRQ
handler has run.

This will lead to the IRQ handler calling `extcon_set_state_sync()` with
a freed `extcon` handle. Which usually crashes the system or otherwise
silently corrupts the memory...

Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `extcon` handle.

Fixes: f8d7a3d21160 ("power: supply: Add driver for pm8916 lbc")
Signed-off-by: Waqar Hameed <waqar.hameed@axis.com>
---
Note that this patch is based on `for-next` branch in Sebastian
Reichel's tree [1]. See the discussion in a previous patch series [2]
for reason and background.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply.git/?h=for-next
[2] https://lore.kernel.org/lkml/64d8dd3675a4e59fa32c3e0ef451f12d1f7ed18f.1766268280.git.waqar.hameed@axis.com/

 drivers/power/supply/pm8916_lbc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/power/supply/pm8916_lbc.c b/drivers/power/supply/pm8916_lbc.c
index 3ca717d84aade..6b631012a7959 100644
--- a/drivers/power/supply/pm8916_lbc.c
+++ b/drivers/power/supply/pm8916_lbc.c
@@ -327,11 +327,6 @@ static int pm8916_lbc_charger_probe(struct platform_device *pdev)
 	if (irq < 0)
 		return irq;
 
-	ret = devm_request_threaded_irq(dev, irq, NULL, pm8916_lbc_charger_state_changed_irq,
-					IRQF_ONESHOT, "pm8916_lbc", chg);
-	if (ret)
-		return ret;
-
 	chg->edev = devm_extcon_dev_allocate(dev, pm8916_lbc_charger_cable);
 	if (IS_ERR(chg->edev))
 		return PTR_ERR(chg->edev);
@@ -340,6 +335,11 @@ static int pm8916_lbc_charger_probe(struct platform_device *pdev)
 	if (ret < 0)
 		return dev_err_probe(dev, ret, "failed to register extcon device\n");
 
+	ret = devm_request_threaded_irq(dev, irq, NULL, pm8916_lbc_charger_state_changed_irq,
+					IRQF_ONESHOT, "pm8916_lbc", chg);
+	if (ret)
+		return ret;
+
 	ret = regmap_read(chg->regmap, chg->reg[LBC_USB] + PM8916_INT_RT_STS, &tmp);
 	if (ret)
 		goto comm_error;

base-commit: 432b119ab8d8bf1f550c247f7fbe960e87ba6c92
-- 
2.39.5

On Fri, 23 Jan 2026 11:24:20 +0100, Waqar Hameed wrote:
> Using the `devm_` variant for requesting IRQ _before_ the `devm_`
> variant for allocating/registering the `extcon` handle, means that the
> `extcon` handle will be deallocated/unregistered _before_ the interrupt
> handler (since `devm_` naturally deallocates in reverse allocation
> order). This means that during removal, there is a race condition where
> an interrupt can fire just _after_ the `extcon` handle has been
> freed, *but* just _before_ the corresponding unregistration of the IRQ
> handler has run.
> 
> [...]

Applied, thanks!

[1/1] power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
      commit: 23067259919663580c6f81801847cfc7bd54fd1f

Best regards,
-- 
Sebastian Reichel <sebastian.reichel@collabora.com>

Waqar Hameed писал(а) 23.01.2026 15:24:
> Using the `devm_` variant for requesting IRQ _before_ the `devm_`
> variant for allocating/registering the `extcon` handle, means that the
> `extcon` handle will be deallocated/unregistered _before_ the interrupt
> handler (since `devm_` naturally deallocates in reverse allocation
> order). This means that during removal, there is a race condition where
> an interrupt can fire just _after_ the `extcon` handle has been
> freed, *but* just _before_ the corresponding unregistration of the IRQ
> handler has run.
> 
> This will lead to the IRQ handler calling `extcon_set_state_sync()` with
> a freed `extcon` handle. Which usually crashes the system or otherwise
> silently corrupts the memory...
> 
> Fix this racy use-after-free by making sure the IRQ is requested _after_
> the registration of the `extcon` handle.
> 
> Fixes: f8d7a3d21160 ("power: supply: Add driver for pm8916 lbc")
> Signed-off-by: Waqar Hameed <waqar.hameed@axis.com>
> ---
> Note that this patch is based on `for-next` branch in Sebastian
> Reichel's tree [1]. See the discussion in a previous patch series [2]
> for reason and background.
> 
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply.git/?h=for-next
> [2] https://lore.kernel.org/lkml/64d8dd3675a4e59fa32c3e0ef451f12d1f7ed18f.1766268280.git.waqar.hameed@axis.com/
> 

Reviewed-by: Nikita Travkin <nikita@trvn.ru>

Thanks!
Nikita

>  drivers/power/supply/pm8916_lbc.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/power/supply/pm8916_lbc.c b/drivers/power/supply/pm8916_lbc.c
> index 3ca717d84aade..6b631012a7959 100644
> --- a/drivers/power/supply/pm8916_lbc.c
> +++ b/drivers/power/supply/pm8916_lbc.c
> @@ -327,11 +327,6 @@ static int pm8916_lbc_charger_probe(struct platform_device *pdev)
>  	if (irq < 0)
>  		return irq;
>  
> -	ret = devm_request_threaded_irq(dev, irq, NULL, pm8916_lbc_charger_state_changed_irq,
> -					IRQF_ONESHOT, "pm8916_lbc", chg);
> -	if (ret)
> -		return ret;
> -
>  	chg->edev = devm_extcon_dev_allocate(dev, pm8916_lbc_charger_cable);
>  	if (IS_ERR(chg->edev))
>  		return PTR_ERR(chg->edev);
> @@ -340,6 +335,11 @@ static int pm8916_lbc_charger_probe(struct platform_device *pdev)
>  	if (ret < 0)
>  		return dev_err_probe(dev, ret, "failed to register extcon device\n");
>  
> +	ret = devm_request_threaded_irq(dev, irq, NULL, pm8916_lbc_charger_state_changed_irq,
> +					IRQF_ONESHOT, "pm8916_lbc", chg);
> +	if (ret)
> +		return ret;
> +
>  	ret = regmap_read(chg->regmap, chg->reg[LBC_USB] + PM8916_INT_RT_STS, &tmp);
>  	if (ret)
>  		goto comm_error;
> 
> base-commit: 432b119ab8d8bf1f550c247f7fbe960e87ba6c92