[PATCH v1] soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove

[PATCH v1] soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove

[Yibo Tan]

pmic_pdcharger_ulog_rpmsg_remove() cancels the delayed worker while the
RPMsg endpoint can still deliver callbacks. The RPMsg core invokes the
driver remove callback before destroying the endpoint, so a response
callback can run after cancel_delayed_work_sync() returns and queue the
worker again.

Device cleanup then frees the devm-allocated pmic_pdcharger_ulog while the
requeued delayed work still embeds and dereferences that object. KASAN
reports a slab-use-after-free in pmic_pdcharger_ulog_work().

Use disable_delayed_work_sync() to drain the worker and reject queue
attempts that race with removal.

The issue was reproduced in four of four runs with the real target driver,
RPMsg bus removal, endpoint teardown, workqueue code and devres cleanup.
The test provider delivered a valid response in the window between the
driver remove callback and endpoint destruction. With this change, the
same late callback occurred in four of four runs without a KASAN report,
warning, Oops or panic.

The reproducer uses a test RPMsg provider to control the teardown timing.
No unprivileged trigger or physical Qualcomm-device result is claimed.

Fixes: 086fdb48bc65 ("soc: qcom: add ADSP PDCharger ULOG driver")
Assisted-by: Codex:GPT-5
Signed-off-by: Yibo Tan <lhfff@tju.edu.cn>
---
 drivers/soc/qcom/pmic_pdcharger_ulog.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/pmic_pdcharger_ulog.c b/drivers/soc/qcom/pmic_pdcharger_ulog.c
index 39f412bbf2c1..06cd9c4411c2 100644
--- a/drivers/soc/qcom/pmic_pdcharger_ulog.c
+++ b/drivers/soc/qcom/pmic_pdcharger_ulog.c
@@ -143,7 +143,7 @@ static void pmic_pdcharger_ulog_rpmsg_remove(struct rpmsg_device *rpdev)
 {
 	struct pmic_pdcharger_ulog *pg = dev_get_drvdata(&rpdev->dev);
 
-	cancel_delayed_work_sync(&pg->ulog_work);
+	disable_delayed_work_sync(&pg->ulog_work);
 }
 
 static const struct rpmsg_device_id pmic_pdcharger_ulog_rpmsg_id_match[] = {
-- 
2.39.5

Re: [PATCH v1] soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove

[Konrad Dybcio]

On 9/12/26 6:12 PM, Yibo Tan wrote:
> pmic_pdcharger_ulog_rpmsg_remove() cancels the delayed worker while the
> RPMsg endpoint can still deliver callbacks. The RPMsg core invokes the
> driver remove callback before destroying the endpoint, so a response
> callback can run after cancel_delayed_work_sync() returns and queue the
> worker again.
> 
> Device cleanup then frees the devm-allocated pmic_pdcharger_ulog while the
> requeued delayed work still embeds and dereferences that object. KASAN
> reports a slab-use-after-free in pmic_pdcharger_ulog_work().
> 
> Use disable_delayed_work_sync() to drain the worker and reject queue
> attempts that race with removal.
> 
> The issue was reproduced in four of four runs with the real target driver,
> RPMsg bus removal, endpoint teardown, workqueue code and devres cleanup.
> The test provider delivered a valid response in the window between the
> driver remove callback and endpoint destruction. With this change, the
> same late callback occurred in four of four runs without a KASAN report,
> warning, Oops or panic.
> 
> The reproducer uses a test RPMsg provider to control the teardown timing.
> No unprivileged trigger or physical Qualcomm-device result is claimed.
> 
> Fixes: 086fdb48bc65 ("soc: qcom: add ADSP PDCharger ULOG driver")
> Assisted-by: Codex:GPT-5
> Signed-off-by: Yibo Tan <lhfff@tju.edu.cn>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad