Re: [PATCH] power: supply: ab8500_fg: fix use-after-free on remove

[Linus Walleij]

On Sun, Aug 2, 2026 at 4:04 AM Fan Wu <fanwu01@xxxxxxxxxx> wrote:

> ab8500_fg_remove() destroys the driver workqueue while the threaded
> interrupt handlers are still armed; they are devm-managed and freed
> only after ->remove() returns, so a handler that fires in that
> window queues work on the freed workqueue.
>
> Tear the workqueue down through devm instead, registering its cleanup
> after the power supply and before the interrupt requests.  devm then
> frees the interrupts first, so the handlers can no longer queue work,
> before disabling the delayed and plain work items and destroying the
> workqueue.  Disabling the items, rather than cancelling them, keeps
> them disabled so no producer (including the power-supply
> external_power_changed callback) can requeue them.
>
> Found by an in-house static analysis tool.
>
> Fixes: 13151631b5bd ("ab8500-fg: A8500 fuel gauge driver")
> Cc: stable@xxxxxxxxxxxxxxx # v6.10+
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>

Neat, I like it!
Reviewed-by: Linus Walleij <linusw@xxxxxxxxxx>

Yours,
Linus Walleij