Re: [PATCH 0/3] power: supply: fix work-vs-devres teardown use-after-free

[khj]

Hi Sebastian,

Sorry about that.... and thanks for taking the time to look.

You're right that the commit messages were far too long. I had added the
"how found / tested" note out of habit -- another subsystem I send to asks
for exactly that information, so I carried it over here without
thinking -- but that is no excuse for the length.
My mistake...
I'll resend as v2: commit messages cut down to the bug and the fix, the
inline comments dropped, no functional change.

Thanks,
Hyunjung

2026년 11월 9일 (월) 오전 10:11, Sebastian Reichel
<sebastian.reichel@xxxxxxxxxxxxx>님이 작성:
>
> Hi,
>
> On Sat, Nov 07, 2026 at 01:00:54AM +0900, hyunjungg wrote:
> > From: Hyunjung Ko <hj351016@xxxxxxxxx>
> >
> > Three power-supply drivers register a poll/detect/charger-detect work for
> > device-managed cancellation (devm_[delayed_]work_autocancel()) in their probe
> > *before* they register the power_supply via devm_power_supply_register(). devres
> > unwinds in reverse order, so on unbind the power_supply device is released first
> > and the work is cancelled last. The work handlers call power_supply_changed()
> > and dereference the power_supply, so a work instance still pending/running in
> > that window touches the already-freed power_supply device -> use-after-free.
> >
> > Each patch moves the devm work-cancel registration to *after*
> > devm_power_supply_register() (and before the IRQ/poll that arms the work), so
> > teardown drains the work before the power_supply is freed. No functional change
> > otherwise. The relocated devm_[delayed_]work_autocancel() still runs its INIT
> > before the work's first queue site, so no queue-before-INIT window is added.
> >
> > This is the same class as the recently-applied cimax2/extcon work-vs-devres
> > fixes. Found by static analysis / code review; none is reproduced on hardware
> > (each needs its charger/PMIC/gauge chip and is not QEMU-reproducible) -- treat
> > accordingly.
>
> Please don not send direct AI output. You need to drop useless
> comments and trim down / rewrite commit messages to a sensible
> length. Instead of huge amount of spam.
>
> Greetings,
>
> -- Sebastian