[PATCH] power: supply: bq24190: stop IRQ and work before supply removal

[PATCH] power: supply: bq24190: stop IRQ and work before supply removal

[Yaohan Li]

bq24190_remove() unregisters its power supplies while a managed IRQ
handler and input_current_limit_work may still access them. The
managed IRQ is only released after remove() returns, so stopping the
supplies first leaves a window for a callback to use freed memory.

Release and synchronize the IRQ before unregistering the supplies,
and cancel the delayed current-limit work. Cancel the work once more
after unregistering to drain any instance requeued by an in-flight
power-supply callback.

A KASAN test with a simulated I2C device and the in-tree charger
driver reproduced the race during removal. The same test completed
without the use-after-free after the change.

Fixes: 4f73a52df7d28278 ("power: supply: bq24190: Avoid rescheduling after cancelling work")
Assisted-by: ZCode:GLM-4
Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
---
 drivers/power/supply/bq24190_charger.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
index 7a5867dd74c23..fd0ea5385f0dd 100644
--- a/drivers/power/supply/bq24190_charger.c
+++ b/drivers/power/supply/bq24190_charger.c
@@ -2265,9 +2265,24 @@ static void bq24190_remove(struct i2c_client *client)
 		dev_warn(bdi->dev, "pm_runtime_get failed: %i\n", error);
 
 	bq24190_register_reset(bdi);
+
+	/*
+	 * The IRQ handler and the input current limit work both access the
+	 * power supplies. Stop them before the supplies are unregistered
+	 * and freed below: the devm cleanup only runs after .remove() has
+	 * returned. The second cancel catches work re-queued by an
+	 * external_power_changed() callback which was still running while
+	 * the supplies were unregistered (the work has a 300 ms delay).
+	 */
+	devm_free_irq(bdi->dev, client->irq, bdi);
+	cancel_delayed_work_sync(&bdi->input_current_limit_work);
+
 	if (bdi->battery)
 		power_supply_unregister(bdi->battery);
 	power_supply_unregister(bdi->charger);
+
+	cancel_delayed_work_sync(&bdi->input_current_limit_work);
+
 	if (error >= 0)
 		pm_runtime_put_sync(bdi->dev);
 	pm_runtime_dont_use_autosuspend(bdi->dev);
-- 
2.34.1

Re: [PATCH] power: supply: bq24190: stop IRQ and work before supply removal

[Sebastian Reichel]

[-- Attachment #1: Type: text/plain, Size: 2649 bytes --]

Hi,

On Wed, Nov 04, 2026 at 05:47:54PM +0800, Yaohan Li wrote:
> bq24190_remove() unregisters its power supplies while a managed IRQ
> handler and input_current_limit_work may still access them. The
> managed IRQ is only released after remove() returns, so stopping the
> supplies first leaves a window for a callback to use freed memory.
> 
> Release and synchronize the IRQ before unregistering the supplies,
> and cancel the delayed current-limit work. Cancel the work once more
> after unregistering to drain any instance requeued by an in-flight
> power-supply callback.
> 
> A KASAN test with a simulated I2C device and the in-tree charger
> driver reproduced the race during removal. The same test completed
> without the use-after-free after the change.
> 
> Fixes: 4f73a52df7d28278 ("power: supply: bq24190: Avoid rescheduling after cancelling work")
> Assisted-by: ZCode:GLM-4
> Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
> ---

The mistake is registering runtime PM and power_supply without
device managed resources. Instead of manually unrolling the device
amanged resources in the reomve function, fix the probe side
instead resulting in a nice cleanup as a side effect.

Greetings,

-- Sebastian

>  drivers/power/supply/bq24190_charger.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
> index 7a5867dd74c23..fd0ea5385f0dd 100644
> --- a/drivers/power/supply/bq24190_charger.c
> +++ b/drivers/power/supply/bq24190_charger.c
> @@ -2265,9 +2265,24 @@ static void bq24190_remove(struct i2c_client *client)
>  		dev_warn(bdi->dev, "pm_runtime_get failed: %i\n", error);
>  
>  	bq24190_register_reset(bdi);
> +
> +	/*
> +	 * The IRQ handler and the input current limit work both access the
> +	 * power supplies. Stop them before the supplies are unregistered
> +	 * and freed below: the devm cleanup only runs after .remove() has
> +	 * returned. The second cancel catches work re-queued by an
> +	 * external_power_changed() callback which was still running while
> +	 * the supplies were unregistered (the work has a 300 ms delay).
> +	 */
> +	devm_free_irq(bdi->dev, client->irq, bdi);
> +	cancel_delayed_work_sync(&bdi->input_current_limit_work);
> +
>  	if (bdi->battery)
>  		power_supply_unregister(bdi->battery);
>  	power_supply_unregister(bdi->charger);
> +
> +	cancel_delayed_work_sync(&bdi->input_current_limit_work);
> +
>  	if (error >= 0)
>  		pm_runtime_put_sync(bdi->dev);
>  	pm_runtime_dont_use_autosuspend(bdi->dev);
> -- 
> 2.34.1
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] power: supply: bq24190: stop IRQ and work before supply removal

[Yaohan Li]

Hi Sebastian,

Thanks for the suggestion. I see what you mean about fixing the resource lifetime from the probe side rather than manually freeing the managed IRQ in remove.

I'll rework the power supply registration and runtime PM cleanup so the resources are released in the right order. I'll also check the delayed work path and the probe error cases before posting v2.

Thanks,
Yaohan