Re: [PATCH v1] soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove

[Bjorn Andersson]

On Sun, 13 Sep 2026 00:12:10 +0800, Yibo Tan wrote:
> pmic_pdcharger_ulog_rpmsg_remove() cancels the delayed worker while the
> RPMsg endpoint can still deliver callbacks. The RPMsg core invokes the
> driver remove callback before destroying the endpoint, so a response
> callback can run after cancel_delayed_work_sync() returns and queue the
> worker again.
> 
> Device cleanup then frees the devm-allocated pmic_pdcharger_ulog while the
> requeued delayed work still embeds and dereferences that object. KASAN
> reports a slab-use-after-free in pmic_pdcharger_ulog_work().
> 
> [...]

Applied, thanks!

[1/1] soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove
      commit: 2354a6131c7d28523675786ca95aadccc7763117

Best regards,
-- 
Bjorn Andersson <andersson@xxxxxxxxxx>