From patchwork Thu Mar 9 17:47:28 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Wang X-Patchwork-Id: 67061 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp431226wrd; Thu, 9 Mar 2023 09:59:17 -0800 (PST) X-Google-Smtp-Source: AK7set+PjFCczRt4+zgR67izPAccMFETjiPohH1uihLQThYOIiHOJA/iQzV1Nfj9rBwN8CkLKm5C X-Received: by 2002:a17:903:1d2:b0:19d:19fb:55fd with SMTP id e18-20020a17090301d200b0019d19fb55fdmr1901491plh.20.1678384757291; Thu, 09 Mar 2023 09:59:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678384757; cv=none; d=google.com; s=arc-20160816; b=chADqMBpG6jhVIQX871ozF+rqkqnrjoc+taZnUHzJpLbZEcX/qg5UnUcK0YG002Z4Y hUM7tcuvaxIYYKc1UXyhbBFaSmIvM/CLtD2r39ZM8UCt+1MVFSX2e+MlRX38AcwjSjfW 0ynNW6DVMPa/36hN+uCd25+sf9GgTgfP8RbICuhw4iW8O+p0IeidIFP1ypxn7q8BV36A +/e6GYc6UoFb5lCfxWqRKJMqfqxnL5p3HAOlGBGxx995KFH2K2O2/o+8O4+zIKgZeZLo dfv0n3w4WFBFWdMS2QeUjYIu+M5xarnOirXLLzHvZnEj7y+hIYayOX3YM/IAGeUT9DxR OWwQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=52mtLhd0shVd0/pdU2xNkr+LALperEX6L2D16EJNEBM=; b=ogpvM8T+QPNPELP1ImQzHofvYhmkI1P6sf8Ia3olUudhgN8U/wdJjEA1oAwEzvwn89 wL2LJoDize++r8rW/4lJRGzsbpWDyK5DaeQ4Y1EdjDbak/iFFdK4O2we7aaYJTgcF930 ziiQDVtT4kl5kcrvPxweW0I1ju6eWmY7ygOBvcv6kFfF3zH1SCoEauPkWohrwvdrNXnx hbbIz1a35EI/ubnnhHN8v+KLZibFKWQUCW9G+SF7enL98DETrDlYIy0L3/siZ5MCYJ3m f7SW3t8aD19RRdBw8z3ohZLyaxTYIfXc9GIr/zPwTz/wJ7Nmslnrm44qZnB910AC6DHk tKHA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=AzrVh8Yy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id le5-20020a170902fb0500b0019edbe2894fsi8022836plb.504.2023.03.09.09.59.00; Thu, 09 Mar 2023 09:59:17 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=AzrVh8Yy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230417AbjCIRsI (ORCPT + 99 others); Thu, 9 Mar 2023 12:48:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52198 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229983AbjCIRsA (ORCPT ); Thu, 9 Mar 2023 12:48:00 -0500 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 5BF91FB242; Thu, 9 Mar 2023 09:47:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=52mtL hd0shVd0/pdU2xNkr+LALperEX6L2D16EJNEBM=; b=AzrVh8YyzCuflDZLcxGk2 pbykbwRaJyAKII3aTvCd9PXb3DKnnFVq7VqJjseevpnVSaT3+cRnH4146cPXwXtK qX2qNmgCMCHfhDRyZTWx5vRSr7rKs12aN9mQFVkkcx7v6+hJ/9K3SV4SY/2Yz6+a ByogpjwSmCwri7D5THPZTM= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by zwqz-smtp-mta-g0-2 (Coremail) with SMTP id _____wDndZqyGwpkzfPcCg--.19913S2; Fri, 10 Mar 2023 01:47:30 +0800 (CST) From: Zheng Wang To: sre@kernel.org Cc: linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org, hackerzheng666@gmail.com, 1395428693sheep@gmail.com, alex000young@gmail.com, Zheng Wang Subject: [PATCH] power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition Date: Fri, 10 Mar 2023 01:47:28 +0800 Message-Id: <20230309174728.233732-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: _____wDndZqyGwpkzfPcCg--.19913S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7uFy3CFW7AF4fKFWfWw45ZFb_yoW8XrWDpw s3Gr90ka1Fqayj9a1Dta12vFy5Ga45GryrCrZ7Gw17ZwnxW39rt34DJF13Gry7Jrn3Xa1I v3s3t3y7KF9xKrJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0ziJ73PUUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiXRgtU1WBo2xwDQAAsd X-Spam-Status: No, score=-0.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_VALIDITY_RPBL,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759913975512480768?= X-GMAIL-MSGID: =?utf-8?q?1759913975512480768?= In bq24190_probe, &bdi->input_current_limit_work is bound with bq24190_input_current_limit_work. When external power changed, it will call bq24190_charger_external_power_changed to start the work. If we remove the module which will call bq24190_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: CPU0 CPUc1 |bq24190_input_current_limit_work bq24190_remove | power_supply_unregister | device_unregister | power_supply_dev_release| kfree(psy) | | | power_supply_get_property_from_supplier | //use Fix it by finishing the work before cleanup in the bq24190_remove Fixes: 97774672573a ("power_supply: Initialize changed_work before calling device_add") Signed-off-by: Zheng Wang --- drivers/power/supply/bq24190_charger.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c index be34b9848450..de67b985f0a9 100644 --- a/drivers/power/supply/bq24190_charger.c +++ b/drivers/power/supply/bq24190_charger.c @@ -1906,6 +1906,7 @@ static void bq24190_remove(struct i2c_client *client) struct bq24190_dev_info *bdi = i2c_get_clientdata(client); int error; + cancel_delayed_work_sync(&bdi->input_current_limit_work); error = pm_runtime_resume_and_get(bdi->dev); if (error < 0) dev_warn(bdi->dev, "pm_runtime_get failed: %i\n", error);