[PATCH] platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: cancel work on teardown

[hyunjungg <hj351016@gmail.com>]

From: Hyunjung Ko <hj351016@gmail.com>

fc->work is scheduled from the extcon notifier callback
yt2_1380_fc_extcon_evt() (and once from probe), but it is never cancelled.
The containing struct yt2_1380_fc and the extcon notifier are both
device-managed on the serdev device, and the serdev driver has no
->remove callback, so teardown happens entirely via devres unwinding
when yt2_1380_fc_pdev_remove() calls serdev_device_remove().

devm_extcon_register_notifier_all() unregistering on teardown only stops
future notifications; it does not drain a work item that the notifier has
already queued. A fast-charger extcon event that races device unbind can
therefore queue fc->work just before teardown; the work then runs after
devres has freed fc, dereferencing freed memory (fc->extcon, fc->dev and
the serdev device) in yt2_1380_fc_worker() -> use-after-free.

Cancel the work via devm_add_action_or_reset(), registered before
devm_extcon_register_notifier_all(). Because devres runs cleanup in
reverse order, the notifier is unregistered first (so it can no longer
queue the work), and only then is the work cancelled, before fc is freed.
This mirrors the teardown-ordering fix used in the axp288 charger driver.

Found by static analysis / code review; compile-tested only, not
reproduced on hardware (requires the Lenovo Yoga Tablet 2 1380 charger).

Fixes: b2ed33e8d486 ("platform/x86: Add lenovo-yoga-tab2-pro-1380-fastcharger driver")
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
--- a/drivers/platform/x86/lenovo/yoga-tab2-pro-1380-fastcharger.c
+++ b/drivers/platform/x86/lenovo/yoga-tab2-pro-1380-fastcharger.c
@@ -148,6 +148,11 @@
 	.write_wakeup = serdev_device_write_wakeup,
 };
 
+static void yt2_1380_fc_cancel_work(void *data)
+{
+	cancel_work_sync(data);
+}
+
 static int yt2_1380_fc_serdev_probe(struct serdev_device *serdev)
 {
 	struct device *dev = &serdev->dev;
@@ -163,6 +168,15 @@
 	INIT_WORK(&fc->work, yt2_1380_fc_worker);
 
 	/*
+	 * Register the work cancellation before the extcon notifier, so that
+	 * devm's reverse-order teardown unregisters the notifier (which may
+	 * queue the work) before the work is cancelled and fc is freed.
+	 */
+	ret = devm_add_action_or_reset(dev, yt2_1380_fc_cancel_work, &fc->work);
+	if (ret)
+		return ret;
+
+	/*
 	 * Do this first since it may return -EPROBE_DEFER.
 	 * There is no extcon_put(), so there is no need to free this.
 	 */
-- 
2.43.0