[PATCH] usb: phy: cancel charger work in usb_remove_phy() to avoid use-after-free

[hyunjungg <hj351016@gmail.com>]

From: Hyunjung Ko <hj351016@gmail.com>

usb_charger_init() (from usb_add_phy()/usb_add_phy_dev()) initializes
usb_phy->chg_work, which is scheduled from the exported
usb_phy_set_charger_current(), usb_phy_set_charger_state() and the
charger-type detection on VBUS/charger events. Its handler
(usb_phy_notify_charger_work) dereferences the usb_phy (notifier chain,
dev, chg_state). usb_remove_phy() only removes the PHY from the lookup
list and never cancels chg_work, so a work scheduled just before a
provider unbinds can still run after the provider has freed the usb_phy
-- a use-after-free.

Cancel chg_work in usb_remove_phy(), after the PHY is off the list (so no
new work can be queued) and before the caller frees the usb_phy. It is
done outside phy_lock since cancel_work_sync() may sleep.

Fixes: a9081a008f84 ("usb: phy: Add USB charger support")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/usb/phy/phy.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/usb/phy/phy.c b/drivers/usb/phy/phy.c
index 5a9b935..caae749 100644
--- a/drivers/usb/phy/phy.c
+++ b/drivers/usb/phy/phy.c
@@ -731,6 +731,15 @@ void usb_remove_phy(struct usb_phy *x)
 	if (x)
 		list_del(&x->head);
 	spin_unlock_irqrestore(&phy_lock, flags);
+
+	/*
+	 * The charger-notify work, scheduled from usb_phy_set_charger_*()
+	 * and the charger-type detection, dereferences the usb_phy. The PHY
+	 * is now off the lookup list, so no new work can be queued; drain any
+	 * work still pending before the caller frees the usb_phy.
+	 */
+	if (x)
+		cancel_work_sync(&x->chg_work);
 }
 EXPORT_SYMBOL_GPL(usb_remove_phy);
 
-- 
2.43.0