Re: [PATCH] hwmon: (gpio-fan) fix use-after-free in alarm work
Guenter Roeck <[email protected]>
| Newsgroups | org.kernel.vger.linux-hwmon,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Wed, Aug 19, 2026 at 03:33:17AM +0000, Fan Wu wrote:
> fan_alarm_irq_handler() queues fan_data->alarm_work, but nothing
> cancels it. fan_alarm_notify() dereferences fan_data and its hwmon
> device. On unbind, devres frees the interrupt, which only waits for
> the handler itself, and then releases the hwmon device and fan_data,
> so a pending fan_alarm_notify() can run after those frees.
>
> Replace INIT_WORK() with devm_work_autocancel(), registered before
> devm_request_irq(). The devres cleanup then frees the interrupt
> first, so no new work can be queued, and cancels the work while
> fan_data and the hwmon device are still alive.
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: d6fe1360f42e ("hwmon: add generic GPIO fan driver")
> Cc: [email protected]
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <[email protected]>
Applied.
Thanks,
Guenter