[PATCH 3/6] backlight: qcom-wled: Cancel delayed work on probe failure

[Lee Jones]

If a short interrupt fires after wled_configure_short_irq() has
registered the interrupt handler, wled_short_irq_handler() calls
wled_module_enable(), which schedules wled->ovp_work.

If wled_probe() subsequently fails during
devm_backlight_device_register(), devres frees the wled structure while
wled->ovp_work remains pending, leading to a use-after-free when
wled_ovp_work() executes.

Configure the OVP interrupt first, then initialise wled->ovp_work via
devm_delayed_work_autocancel() before requesting the short interrupt.
This ensures that on teardown devres frees the short interrupt first,
cancels any pending wled->ovp_work while wled->ovp_irq is still valid,
and finally frees the OVP interrupt and wled structure.

Fixes: 8663c188beea ("backlight: qcom-wled: Add auto string detection logic")
Closes: https://sashiko.dev/#/bug/linux-ca2e48a2-f511-44b8-a7d4-866f360bf107
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
Cc: David Heidelberg <david@xxxxxxx>
Cc: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>

 drivers/video/backlight/qcom-wled.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index ca350f320e17..f8f41e1d6ccf 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -3,6 +3,7 @@
  */
 
 #include <linux/delay.h>
+#include <linux/devm-helpers.h>
 #include <linux/interrupt.h>
 #include <linux/ktime.h>
 #include <linux/kernel.h>
@@ -1784,8 +1785,6 @@ static int wled_probe(struct platform_device *pdev)
 		break;
 	}
 
-	INIT_DELAYED_WORK(&wled->ovp_work, wled_ovp_work);
-
 	val = WLED_DEFAULT_BRIGHTNESS;
 	of_property_read_u32(pdev->dev.of_node, "default-brightness", &val);
 
@@ -1800,14 +1799,19 @@ static int wled_probe(struct platform_device *pdev)
 
 	wled->brightness = rc;
 
-	rc = wled_configure_short_irq(wled, pdev);
-	if (rc < 0)
-		return rc;
-
 	rc = wled_configure_ovp_irq(wled, pdev);
 	if (rc < 0)
 		return rc;
 
+	rc = devm_delayed_work_autocancel(&pdev->dev, &wled->ovp_work,
+					  wled_ovp_work);
+	if (rc)
+		return rc;
+
+	rc = wled_configure_short_irq(wled, pdev);
+	if (rc < 0)
+		return rc;
+
 	memset(&props, 0, sizeof(struct backlight_properties));
 	props.type = BACKLIGHT_RAW;
 	props.brightness = wled->brightness ?: val;
-- 
2.56.0.385.gac671c819a-goog