Re: [PATCH] power: supply: ab8500_fg: fix use-after-free on remove
Sebastian Reichel <[email protected]> Tue, 04 Aug 2026 01:01:54 +0200
| Newsgroups | org.kernel.vger.linux-pm,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <178579811468.234019.4487541526073009513.b4-ty@b4> |
On Sun, 02 Aug 2026 02:03:16 +0000, Fan Wu wrote:
> ab8500_fg_remove() destroys the driver workqueue while the threaded
> interrupt handlers are still armed; they are devm-managed and freed
> only after ->remove() returns, so a handler that fires in that
> window queues work on the freed workqueue.
>
> Tear the workqueue down through devm instead, registering its cleanup
> after the power supply and before the interrupt requests. devm then
> frees the interrupts first, so the handlers can no longer queue work,
> before disabling the delayed and plain work items and destroying the
> workqueue. Disabling the items, rather than cancelling them, keeps
> them disabled so no producer (including the power-supply
> external_power_changed callback) can requeue them.
>
> [...]
Applied, thanks!
[1/1] power: supply: ab8500_fg: fix use-after-free on remove
commit: 75b1e88d34254f4fb7753345e21bfee47abddd7f
Best regards,
--
Sebastian Reichel <[email protected]>