Re: [PATCH v4 01/11] power: supply: Add registration init callback

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free of `psy->changed_work` in `__power_supply_register()` error path.
--

--- Patch [1]: [PATCH v4 01/11] power: supply: Add registration init callback ---
commit 91f996f8711a8d5770312f212add1d5d3cecfc83
Author: Vincent Cloutier <vincent@cloutier.co>

power: supply: Add registration init callback

This commit adds an optional registration init callback for battery drivers
to consume monitored-battery data before their power_supply is visible.

> diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
> index 2532e221b2e19..3ed4c253706f3 100644
> --- a/drivers/power/supply/power_supply_core.c
> +++ b/drivers/power/supply/power_supply_core.c
> @@ -1624,6 +1624,14 @@ __power_supply_register(struct device *parent,
>  	init_rwsem(&psy->extensions_sem);
>  	INIT_LIST_HEAD(&psy->extensions);
>  
> +	if (desc->init) {
> +		rc = desc->init(psy);
> +		if (WARN_ON_ONCE(rc > 0))
> +			rc = -EINVAL;
> +		if (rc)
> +			goto check_supplies_failed;
> +	}
> +
>  	rc = device_add(dev);

[Severity: High]
This is a pre-existing issue, but does the error path handling after this
device_add() call lead to a use-after-free of psy->changed_work?

If device_add() succeeds, the device is published to the power_supply class.
Another thread can then find the published device via
power_supply_get_by_name(), take a reference, and call power_supply_changed(),
which queues psy->changed_work on the system workqueue.

If a subsequent initialization step in __power_supply_register() fails
(such as psy_register_thermal), the code jumps to the error path:

register_thermal_failed:
wakeup_init_failed:
        device_del(dev);
device_add_failed:
check_supplies_failed:
dev_set_name_failed:
        put_device(dev);
        return ERR_PTR(rc);

This drops the local reference to the power supply structure via put_device()
but omits canceling any potentially queued work with
cancel_work_sync(&psy->changed_work).

Once the other thread drops its reference, psy is freed by
power_supply_dev_release(). The system workqueue will then dereference the
freed memory when it executes power_supply_changed_work().

>  	if (rc)
>  		goto device_add_failed;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727011319.621794-1-vincent.cloutier@icloud.com?part=1