Re: [PATCH 1/5] extcon: max14577: cancel wq_detcable on driver unbind

Re: [PATCH 1/5] extcon: max14577: cancel wq_detcable on driver unbind

[Yaohan Li]

Hello Tristan,

We independently reproduced the max14577 delayed-work use-after-free
and tested your [PATCH 1/5] ("extcon: max14577: cancel wq_detcable
on driver unbind") on a clean Linux v7.4-rc1 tree (6628e7d4c6b2).

Test setup:
  - QEMU/KVM with KASAN enabled
  - Self-registered I2C adapter exercising the real max14577
    MFD and extcon probe/remove paths
  - wq_detcable scheduled with the driver's 17-second delay
  - Device unregistered before the delayed work would run

Results:
  - Unpatched v7.4-rc1: 80 slab-use-after-free reports,
    starting when the delayed-work timer expires
  - Your [1/5] applied to the clean tree: 0 KASAN reports,
    with the test running more than four seconds beyond
    the original expiry point
  - Control run without early unbind: 0 KASAN reports

This test applied your posted patch rather than only our own
equivalent devm_delayed_work_autocancel() change. The result
supports the fix for the tested driver-unbind sequence; the
synthetic I2C setup has not been checked against physical
hardware.

Tested-by: Yaohan Li <shunsheng1218@gmail.com>

We can provide the complete console logs, configuration, and
reproduction details privately if useful. The investigation
was AI-assisted, with source analysis and test results
reviewed by the human tester.

Best regards,
Yaohan Li

[PATCH 0/5] extcon: cancel wq_detcable delayed work on driver unbind

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

Several extcon MUIC drivers schedule a delayed work (wq_detcable) during
probe for post-boot cable state detection, but never cancel it on driver
unbind.  If the device is removed before the work fires, the callback
dereferences freed memory.

Use devm_delayed_work_autocancel() to tie the work lifecycle to the
device.  This matches the pattern already used by extcon-gpio,
extcon-palmas, extcon-qcom-spmi-misc, and extcon-intel-int3496.

For the Maxim drivers (max14577, max77693, max8997), irq_work was
already converted to devm_work_autocancel() but wq_detcable was missed.
The rt8973a and sm5502 drivers also need the devm-helpers.h include.

Tristan Madani (5):
  extcon: max14577: cancel wq_detcable on driver unbind
  extcon: max77693: cancel wq_detcable on driver unbind
  extcon: max8997: cancel wq_detcable on driver unbind
  extcon: rt8973a: cancel wq_detcable on driver unbind
  extcon: sm5502: cancel wq_detcable on driver unbind

 drivers/extcon/extcon-max14577.c | 5 ++++-
 drivers/extcon/extcon-max77693.c | 5 ++++-
 drivers/extcon/extcon-max8997.c  | 5 ++++-
 drivers/extcon/extcon-rt8973a.c  | 6 +++++-
 drivers/extcon/extcon-sm5502.c   | 6 +++++-
 5 files changed, 22 insertions(+), 5 deletions(-)

-- 
2.47.3

[PATCH 1/5] extcon: max14577: cancel wq_detcable on driver unbind

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

The driver schedules wq_detcable as a delayed work during probe but
never cancels it.  If the device is unbound before the work fires, the
callback dereferences freed memory because the driver data is managed
by devm.

Use devm_delayed_work_autocancel() so the work is automatically
cancelled when the device is removed, matching the existing irq_work
conversion done in the same driver.

Fixes: 962e56bfcf0b ("extcon: max14577: Add extcon-max14577 driver to support MUIC device")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/extcon/extcon-max14577.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/extcon/extcon-max14577.c b/drivers/extcon/extcon-max14577.c
index 5476f48ed74b9..905722ede7ab1 100644
--- a/drivers/extcon/extcon-max14577.c
+++ b/drivers/extcon/extcon-max14577.c
@@ -763,7 +763,10 @@ static int max14577_muic_probe(struct platform_device *pdev)
 	 * After completing the booting of platform, the extcon provider
 	 * driver should notify cable state to upper layer.
 	 */
-	INIT_DELAYED_WORK(&info->wq_detcable, max14577_muic_detect_cable_wq);
+	ret = devm_delayed_work_autocancel(&pdev->dev, &info->wq_detcable,
+					   max14577_muic_detect_cable_wq);
+	if (ret)
+		return ret;
 	queue_delayed_work(system_power_efficient_wq, &info->wq_detcable,
 			delay_jiffies);
 
-- 
2.47.3