Re: [PATCH v1] soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove

[Abel Vesa]

On 26-09-13 00:12:10, Yibo Tan wrote:
> pmic_pdcharger_ulog_rpmsg_remove() cancels the delayed worker while the
> RPMsg endpoint can still deliver callbacks. The RPMsg core invokes the
> driver remove callback before destroying the endpoint, so a response
> callback can run after cancel_delayed_work_sync() returns and queue the
> worker again.
> 
> Device cleanup then frees the devm-allocated pmic_pdcharger_ulog while the
> requeued delayed work still embeds and dereferences that object. KASAN
> reports a slab-use-after-free in pmic_pdcharger_ulog_work().
> 
> Use disable_delayed_work_sync() to drain the worker and reject queue
> attempts that race with removal.
> 
> The issue was reproduced in four of four runs with the real target driver,
> RPMsg bus removal, endpoint teardown, workqueue code and devres cleanup.
> The test provider delivered a valid response in the window between the
> driver remove callback and endpoint destruction. With this change, the
> same late callback occurred in four of four runs without a KASAN report,
> warning, Oops or panic.
> 
> The reproducer uses a test RPMsg provider to control the teardown timing.
> No unprivileged trigger or physical Qualcomm-device result is claimed.
> 
> Fixes: 086fdb48bc65 ("soc: qcom: add ADSP PDCharger ULOG driver")
> Assisted-by: Codex:GPT-5
> Signed-off-by: Yibo Tan <lhfff@xxxxxxxxxx>

Reviewed-by: Abel Vesa <abel.vesa@xxxxxxxxxxxxxxxx>