Re: [PATCH 0/3] power: supply: fix work-vs-devres teardown use-after-free

[Sebastian Reichel <sebastian.reichel@collabora.com>]

[-- Attachment #1: Type: text/plain, Size: 1538 bytes --]

Hi,

On Sat, Nov 07, 2026 at 01:00:54AM +0900, hyunjungg wrote:
> From: Hyunjung Ko <hj351016@gmail.com>
> 
> Three power-supply drivers register a poll/detect/charger-detect work for
> device-managed cancellation (devm_[delayed_]work_autocancel()) in their probe
> *before* they register the power_supply via devm_power_supply_register(). devres
> unwinds in reverse order, so on unbind the power_supply device is released first
> and the work is cancelled last. The work handlers call power_supply_changed()
> and dereference the power_supply, so a work instance still pending/running in
> that window touches the already-freed power_supply device -> use-after-free.
> 
> Each patch moves the devm work-cancel registration to *after*
> devm_power_supply_register() (and before the IRQ/poll that arms the work), so
> teardown drains the work before the power_supply is freed. No functional change
> otherwise. The relocated devm_[delayed_]work_autocancel() still runs its INIT
> before the work's first queue site, so no queue-before-INIT window is added.
> 
> This is the same class as the recently-applied cimax2/extcon work-vs-devres
> fixes. Found by static analysis / code review; none is reproduced on hardware
> (each needs its charger/PMIC/gauge chip and is not QEMU-reproducible) -- treat
> accordingly.

Please don not send direct AI output. You need to drop useless
comments and trim down / rewrite commit messages to a sensible
length. Instead of huge amount of spam.

Greetings,

-- Sebastian

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]