Re: [PATCH] soc: qcom: pmic_glink_altmode: Fix use-after-free of work items on unbind

[Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>]

On 11/2/26 12:07 PM, Abel Vesa wrote:
> The altmode context, including the enable_work and the per-port work
> items, is devm-allocated, but nothing cancels the work items on unbind.
> A PDR or GLINK notification can queue them on the system workqueues, so
> if the device gets unbound while one is pending or running, devres frees
> the context, the typec handles and the pmic_glink client under it, and
> the worker then dereferences freed memory.
> 
> Cancelling the work items is not enough on its own, since the client
> callbacks keep queueing them until the client devres is released. So
> register a devm action, right after the client is allocated, which
> disables the works using disable_work_sync(). Devres runs actions in
> reverse order, so on unbind this happens first, waiting for any running
> worker while the client, typec handles and bridges are still around,
> and making any later queueing from the client callbacks a no-op.
> 
> Fixes: 080b4e24852b ("soc: qcom: pmic_glink: Introduce altmode support")
> Cc: stable@vger.kernel.org # 6.10
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/bug/linux-762f89d1-07b0-45e1-9557-bf643a826aa1
> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
> ---
> Prepared with help from an LLM-based assistant.
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad