[PATCH] usb: typec: altmodes/displayport: Disable work before dp is freed

[PATCH] usb: typec: altmodes/displayport: Disable work before dp is freed

[Fan Wu]

dp_altmode_remove() cancels dp->work with cancel_work_sync(), but the
typec bus clears alt->ops only after ->remove() has returned, so the
dp_altmode_vdm(), dp_cable_altmode_vdm() and dp_altmode_attention()
callbacks can still call schedule_work(&dp->work) after the cancel. dp
is devm-allocated on the partner altmode device and is freed once the
unbind completes; a re-queued dp_altmode_work() may then run on freed
memory.

Fix this by disabling the work instead of only cancelling it.
disable_work_sync() drains an in-flight dp_altmode_work() and keeps the
work item disabled, so the late schedule_work() calls are rejected. The
work is still drained before the plug reference is dropped.

A later probe initializes a new work item, and the remove path holds no
lock that dp_altmode_work() takes, so waiting cannot deadlock.

This issue was found by an in-house static analysis tool.

Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode")
Cc: stable@vger.kernel.org # v6.10+
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
index d96ab106a980..f7b3566d4029 100644
@@ -815,7 +815,7 @@
 {
 	struct dp_altmode *dp = typec_altmode_get_drvdata(alt);
 
-	cancel_work_sync(&dp->work);
+	disable_work_sync(&dp->work);
 	typec_altmode_put_plug(dp->plug_prime);
 
 	if (dp->connector_fwnode) {

Re: [PATCH] usb: typec: altmodes/displayport: Disable work before dp is freed

[Huang Wei]

Hi Fan,

I checked this over and the race is real - typec_remove() in the typec
bus only clears adev->ops after drv->remove() has returned, and it
even calls typec_altmode_set_state(adev, TYPEC_STATE_SAFE, NULL) in
between, so dp_altmode_vdm() and friends can definitely re-queue
dp->work after the cancel_work_sync() in dp_altmode_remove(). With dp
being devm-allocated that is a use-after-free waiting to happen.

disable_work_sync() is the right fix here - it drains the work and
rejects the late schedule_work() calls, and since probe always runs
INIT_WORK on a freshly allocated dp there is no risk of the disabled
state leaking into a later bind.

Reviewed-by: Huang Wei <huangwei@kylinos.cn>

Thanks,
Huang Wei

Re: [PATCH] usb: typec: altmodes/displayport: Disable work before dp is freed

[Heikki Krogerus]

On Wed, Sep 23, 2026 at 02:46:37AM +0000, Fan Wu wrote:
> dp_altmode_remove() cancels dp->work with cancel_work_sync(), but the
> typec bus clears alt->ops only after ->remove() has returned, so the
> dp_altmode_vdm(), dp_cable_altmode_vdm() and dp_altmode_attention()
> callbacks can still call schedule_work(&dp->work) after the cancel. dp
> is devm-allocated on the partner altmode device and is freed once the
> unbind completes; a re-queued dp_altmode_work() may then run on freed
> memory.
> 
> Fix this by disabling the work instead of only cancelling it.
> disable_work_sync() drains an in-flight dp_altmode_work() and keeps the
> work item disabled, so the late schedule_work() calls are rejected. The
> work is still drained before the plug reference is dropped.
> 
> A later probe initializes a new work item, and the remove path holds no
> lock that dp_altmode_work() takes, so waiting cannot deadlock.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode")
> Cc: stable@vger.kernel.org # v6.10+
> Co-developed-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
> index d96ab106a980..f7b3566d4029 100644
> @@ -815,7 +815,7 @@
>  {
>  	struct dp_altmode *dp = typec_altmode_get_drvdata(alt);
>  
> -	cancel_work_sync(&dp->work);
> +	disable_work_sync(&dp->work);
>  	typec_altmode_put_plug(dp->plug_prime);
>  
>  	if (dp->connector_fwnode) {

-- 
heikki