[PATCH] mfd: ls2kbmc: cancel the reset work before the driver data is freed

[PATCH] mfd: ls2kbmc: cancel the reset work before the driver data is freed

[hyunjungg]

From: Hyunjung Ko <hj351016@gmail.com>

ls2k_bmc_init() INIT_WORK()s ddata->bmc_reset_work (ls2k_bmc_events_fn)
and requests two device-managed interrupts (ls2k_bmc_interrupt) that
schedule_work(&ddata->bmc_reset_work).  The work handler dereferences
ddata via container_of().

ddata is devm_kzalloc()'d, so devres frees it when the device is
unbound.  Nothing cancels bmc_reset_work: free_irq() (run by devres)
only waits for the interrupt handler to finish, not for a work item it
has already queued.  If a BMC reset interrupt fires shortly before
unbind, the queued ls2k_bmc_events_fn() can run after ddata has been
freed -> use-after-free.

Register the work for device-managed cancellation with
devm_work_autocancel(), before the devm_request_irq() calls that arm
it, so devres (LIFO) frees the interrupts first, then cancels the work,
and only then frees ddata.

Found by code review; not reproduced (needs Loongson-2K BMC hardware and
a reset interrupt racing driver unbind).

Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/mfd/ls2k-bmc-core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
index 408056b..c44291e 100644
--- a/drivers/mfd/ls2k-bmc-core.c
+++ b/drivers/mfd/ls2k-bmc-core.c
@@ -12,6 +12,7 @@
 #include <linux/aperture.h>
 #include <linux/bitfield.h>
 #include <linux/delay.h>
+#include <linux/devm-helpers.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/iopoll.h>
@@ -371,7 +372,10 @@ static int ls2k_bmc_init(struct ls2k_bmc_ddata *ddata)
 
 	ls2k_bmc_save_pci_data(pdev, ddata);
 
-	INIT_WORK(&ddata->bmc_reset_work, ls2k_bmc_events_fn);
+	ret = devm_work_autocancel(ddata->dev, &ddata->bmc_reset_work,
+				   ls2k_bmc_events_fn);
+	if (ret)
+		return ret;
 
 	ret = devm_request_irq(&pdev->dev, pdev->irq, ls2k_bmc_interrupt,
 			       IRQF_SHARED | IRQF_TRIGGER_FALLING, "ls2kbmc pcie", ddata);
-- 
2.43.0

Re: [PATCH] mfd: ls2kbmc: cancel the reset work before the driver data is freed

[Binbin Zhou]

Hi:

On 2026/11/7 13:32, hyunjungg wrote:
> From: Hyunjung Ko <hj351016@gmail.com>
> 
> ls2k_bmc_init() INIT_WORK()s ddata->bmc_reset_work (ls2k_bmc_events_fn)
> and requests two device-managed interrupts (ls2k_bmc_interrupt) that
> schedule_work(&ddata->bmc_reset_work).  The work handler dereferences
> ddata via container_of().
> 
> ddata is devm_kzalloc()'d, so devres frees it when the device is
> unbound.  Nothing cancels bmc_reset_work: free_irq() (run by devres)
> only waits for the interrupt handler to finish, not for a work item it
> has already queued.  If a BMC reset interrupt fires shortly before
> unbind, the queued ls2k_bmc_events_fn() can run after ddata has been
> freed -> use-after-free.
> 
> Register the work for device-managed cancellation with
> devm_work_autocancel(), before the devm_request_irq() calls that arm
> it, so devres (LIFO) frees the interrupts first, then cancels the work,
> and only then frees ddata.
> 
> Found by code review; not reproduced (needs Loongson-2K BMC hardware and
> a reset interrupt racing driver unbind).
> 
> Fixes: d952bba3fbb5 ("mfd: ls2kbmc: Add Loongson-2K BMC reset function support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
> ---
>   drivers/mfd/ls2k-bmc-core.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/mfd/ls2k-bmc-core.c b/drivers/mfd/ls2k-bmc-core.c
> index 408056b..c44291e 100644
> --- a/drivers/mfd/ls2k-bmc-core.c
> +++ b/drivers/mfd/ls2k-bmc-core.c
> @@ -12,6 +12,7 @@
>   #include <linux/aperture.h>
>   #include <linux/bitfield.h>
>   #include <linux/delay.h>
> +#include <linux/devm-helpers.h>
>   #include <linux/errno.h>
>   #include <linux/init.h>
>   #include <linux/iopoll.h>
> @@ -371,7 +372,10 @@ static int ls2k_bmc_init(struct ls2k_bmc_ddata *ddata)
>   
>   	ls2k_bmc_save_pci_data(pdev, ddata);
>   
> -	INIT_WORK(&ddata->bmc_reset_work, ls2k_bmc_events_fn);
> +	ret = devm_work_autocancel(ddata->dev, &ddata->bmc_reset_work,
> +				   ls2k_bmc_events_fn);
> +	if (ret)
> +		return ret;


Lee had already fixed this issue:

https://lore.kernel.org/all/20261027093306.2812695-4-lee@kernel.org/
>   
>   	ret = devm_request_irq(&pdev->dev, pdev->irq, ls2k_bmc_interrupt,
>   			       IRQF_SHARED | IRQF_TRIGGER_FALLING, "ls2kbmc pcie", ddata);

-- 
Thanks.
Binbin