[BUG/RFC] extcon: potential lifetime race between provider unregister and active consumers

[zhang san]

Hello,

We would appreciate your review of a possible lifetime gap in the
extcon core (drivers/extcon/extcon.c).

extcon_get_extcon_dev() returns a struct extcon_dev pointer after
releasing extcon_dev_list_lock, without taking a reference for the
consumer. Meanwhile, extcon_dev_unregister() removes the provider from
the list and releases its internal resources. A consumer continuing to
use the saved pointer may then access resources whose lifetime has
ended.

On Linux v7.4-rc1 (6628e7d4c6b2), our KASAN tests with self-registered
provider and consumer devices exercising public extcon APIs produced
use-after-free reports in three scenarios:

1. extcon_get_state() after provider unregister;
2. extcon_unregister_notifier() after the notifier storage was freed;
3. concurrent consumer and provider unbind.

Controls without provider unbind produced no reports. These are
synthetic provider/consumer setups, not a reproduction on production
hardware, and we have not established whether actual consumers must
guarantee that the provider remains bound through device links or
other ordering rules.

Could you clarify the intended lifetime and ownership contract for the
pointer returned by extcon_get_extcon_dev()? In particular, is use
after provider unbind expressly forbidden by the API contract, or
should the core provide a reference or other synchronization?
Depending on the intended contract, would you favor explicit
refcounting, documented consumer-side lifetime constraints, or another
approach?

We have not proposed a patch because the right solution may require
API-level design decisions. We can privately provide the reproducer,
KASAN allocation/free/access stacks, and kernel configuration on
request.

If a fix is proposed, please CC me on the patch. I would be happy to
rerun the KASAN reproducer against the exact revision and provide a
Tested-by tag if it passes. If this report leads to a confirmed bug
fix, it can also serve as the reference for an appropriate Reported-by
credit.

This issue was found during an AI-assisted source audit and reviewed
through source inspection and KASAN experiments.

Best regards
Yaohan Li