From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 71CE83148D2 for ; Thu, 2 Jul 2026 17:21:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783012894; cv=none; b=SaxiY7wecMFiZwjcNdKgRFFm28vLpiCrvqstlR2fK0yNIGOClv4Bfh5PhtSCjURnu+iMsrDszgF0BcG3/K3PMJWlxlc+Nx2c7KH5+gei4JPa3ZUWrAayoQClgBRDFIWV1DcTtsnpFsnRooqZj/7NAvkbBIgFy7kE/tDOzLrNjZE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783012894; c=relaxed/simple; bh=b0lX8e4U6pwzeZiC8tEAhyeN3fmZCGQDnXri2F0aTa4=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=enoCs6HyJl1AQMA9vVD7CRIcfCy0otr4hPorIArKFWvHDGJIpQgleQx0tMdgAK7ZJI/c/BLVfLDiLXAQEmntl1KWzLTJI1Xk4cdSS2rztWsw7Wmtc/6S9P12YEz0giWKEyFPkuHk1ChdbB+ysjxZu7nCYRr4SMbqdXSlS/frACw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=M9w+Wits; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="M9w+Wits" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2c825c88744so20671605ad.1 for ; Thu, 02 Jul 2026 10:21:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783012893; x=1783617693; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=1GZ8xT+OaufdSVmI4IoriQUBqzfum3lVc6zF74xw7wM=; b=M9w+Wits+kj6rmoRnqcem3yXi9xZ0slxFw9h9eKQfalb2eB1WGV4m5oTV6Y2SiwN+4 +6T3dj2oZ9PaqeK2GcVv88oVG8mF9V0zd+Xt0fQTqZuq6ZyHyqIMRlaMPTbroTh5rkCU XtB7S0hWUmPF5aenp8jQxE8Zl8dykrR39HtACEPAQkjcOf+pFEhEiUDBJBW3mAVYgb4L dMjGguP6JkzpS087Pgk4OBAyBFS33hRW+DYZRUMs/87jba2bZC4zscKCgebrZ8oNcuti g4d/NSbPMbo5zBOJC0F/H9U7q/il3s9mSesgoPbwZI3glgTWHaRbA/FifWXg915dSCQZ 7dqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783012893; x=1783617693; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=1GZ8xT+OaufdSVmI4IoriQUBqzfum3lVc6zF74xw7wM=; b=Oly96c0uGhZv1GybMGp0oMDEQcDLajTutVzsmiyCPblyll+xtGN/lrN3sXdEXAjKfZ svHBn5BCBDtjDoRebC6LhAlNvhWfwxEBmh0FPCrIUb7mvlJ9Nlqlh39KaNrkaCxyhx4l cBufDSyIKvdgaKrj3aTEsXbJs0XZoXOfxQbdHJwStmf3KmmK81C7IrEM6S34HNXBuVXy YUooLhm21AnKQGP0L9MuGpkquybqOkBQ6L++mrxiUfP7UKMMN185VmTezmnL0nUXt0MH 8rP8o94Vw7MAw99SzelmXE95cNLu/Wb9HSKBXUgWEEdmYIFiMZaf98QoOJPphmw+0OTZ 0KLg== X-Forwarded-Encrypted: i=1; AHgh+RohecP7NeE14DxQgKhg/Iu2RamCShizqO+KjAXyeGWV08BRScyIJ6NLBVy0ZWqLwH9oOBBJwFCGFZ3MHOo=@vger.kernel.org X-Gm-Message-State: AOJu0Yy2yqH+Dd/c6A1s6p6C+OuaEqr2TzVBGcbCw48MybiPW25CDpV+ fNHZEhfFwvFfcW/EqczHvggtUyaAJPQHs41bzBZUqgRpIvru0QZ3Sc0p X-Gm-Gg: AfdE7cki0bfIwii/GEizgdskSgD9AiiUbF1KrAATKawZ2UIGmgAw9CL3qcZbo6UknXp Ev/Xt0xdQ744Cg0tOH07rLEE4BgVxQcOIsHueNeay4/SG+3ihiYpW1s6WADtp/PTxIeA7K0X5Uw t77cQCBIJezNJkxvmZljfRdgBcCk2HRMm+XQstOXxBHtoNaJRawwHsUPj4R3k+gU7wK8ig+Hy6N NoY1TSgZwR4SPdF6MbBdD2Z8slWUlODrsf4nv1+Yf48rV/1Z+vSEcaMdZhIfaGjI7muYl73SI9C blxfJ9i+3OupZVJoXznIkAah7IKksWVc3i2QsJk3t70e7iZo8iXw3xmeg+IgeKkYMAPGjEcpJFJ g5yU6ViYzPTpOen9+jomdDHKh1h4XdH9hkD9LpUklCbZ1ovi7eDJcH73yCUv5AqnRvUgmMFW3nr vsdXIWoaCz8OZDiYRzZ391t7rFkXzLdWcJhfWAIw== X-Received: by 2002:a17:902:ec8c:b0:2c9:e9c7:2b57 with SMTP id d9443c01a7336-2ca7e67d181mr74249445ad.4.1783012892624; Thu, 02 Jul 2026 10:21:32 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ca9a9fee7csm16624055ad.69.2026.07.02.10.21.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Jul 2026 10:21:32 -0700 (PDT) From: Maoyi Xie To: Sebastian Reichel Cc: linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: twl4030_charger: worker not cancelled on remove? Date: Fri, 3 Jul 2026 01:21:28 +0800 Message-Id: <20260702172128.2001753-1-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi Sebastian, twl4030_charger looks like it has the worker race on remove that bq25890 fixed (commit 7e6fb67808ab). I would appreciate it if you could take a look. The driver data is allocated with devm in probe: bci = devm_kzalloc(&pdev->dev, sizeof(*bci), GFP_KERNEL); It has two workers that both dereference bci: INIT_WORK(&bci->work, twl4030_bci_usb_work); INIT_DELAYED_WORK(&bci->current_worker, twl4030_current_worker); twl4030_bci_remove() disables charging and masks interrupts. It cancels neither worker. A worker still pending at remove runs after devm frees bci, so it touches freed memory. bq25890 fixed the same shape by unregistering the USB notifier, then cancel_work_sync() on remove. twl4030 is different. Its notifier comes from devm_usb_get_phy_by_node(), so devm unregisters it after remove() returns. A plain cancel in remove() could then still race a reschedule. So a single cancel in remove() is not enough. current_worker does not depend on the notifier. It reschedules itself, so it needs cancel_delayed_work_sync regardless. Does this look like a real bug? If it does, I am happy to send a patch. I am not sure of the best shape here. One option is to move the phy off devm and mirror bq25890. Another is to coordinate the cancel differently. What would you prefer? I do not have the hardware. The use-after-free is from a KASAN harness. It runs the worker after the bci free. Thanks, Maoyi