[PATCH] power: supply: sbs-battery: disable polling before supply teardown

[PATCH] power: supply: sbs-battery: disable polling before supply teardown

[Myeonghun Pak]

The managed poll-work cancellation is registered before the power
supply, so cleanup unregisters the supply before draining polling.
A pending or running poller can then call power_supply_changed() on
the released supply.

Commit 8d59cf3887fb ("power: supply: sbs-battery: Fix use-after-free in
power_supply_changed()") moved the IRQ request after supply registration,
but did not change the poll-work cancellation order.

Add a later managed action that disables and drains polling before
supply teardown. Its retained disabled state prevents external-power
callbacks from rearming the poll work after it has been drained.
Keep the original autocancel to initialize work before supply callbacks
can run and to cover failed supply registration.

The teardown ordering issue was found by static analysis.

Fixes: 6d0c5de2fd84 ("power: supply: Clean-up few drivers by using managed work init")
Cc: stable@vger.kernel.org # 6.10+
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/power/supply/sbs-battery.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/power/supply/sbs-battery.c b/drivers/power/supply/sbs-battery.c
index 501c8e069755..6714313bb3a3 100644
--- a/drivers/power/supply/sbs-battery.c
+++ b/drivers/power/supply/sbs-battery.c
@@ -1068,6 +1068,13 @@ static void sbs_alert(struct i2c_client *client, enum i2c_alert_protocol prot,
 	sbs_supply_changed(i2c_get_clientdata(client));
 }
 
+static void sbs_disable_work(void *data)
+{
+	struct sbs_info *chip = data;
+
+	disable_delayed_work_sync(&chip->work);
+}
+
 static void sbs_external_power_changed(struct power_supply *psy)
 {
 	struct sbs_info *chip = power_supply_get_drvdata(psy);
@@ -1208,6 +1215,10 @@ static int sbs_probe(struct i2c_client *client)
 		return dev_err_probe(&client->dev, PTR_ERR(chip->power_supply),
 				     "Failed to register power supply\n");
 
+	rc = devm_add_action_or_reset(&client->dev, sbs_disable_work, chip);
+	if (rc)
+		return rc;
+
 	if (!chip->gpio_detect)
 		goto out;
 

Re: [PATCH] power: supply: sbs-battery: disable polling before supply teardown

[Sebastian Reichel]

On Sun, 04 Oct 2026 00:10:19 -0400, Myeonghun Pak wrote:
> The managed poll-work cancellation is registered before the power
> supply, so cleanup unregisters the supply before draining polling.
> A pending or running poller can then call power_supply_changed() on
> the released supply.
> 
> Commit 8d59cf3887fb ("power: supply: sbs-battery: Fix use-after-free in
> power_supply_changed()") moved the IRQ request after supply registration,
> but did not change the poll-work cancellation order.
> 
> [...]

Applied, thanks!

[1/1] power: supply: sbs-battery: disable polling before supply teardown
      commit: 5c1c602463d597c5189ddc5a73dece588ba2c57a

Best regards,
-- 
Sebastian Reichel <sebastian.reichel@collabora.com>