Re: [PATCH] staging: nvec: fix race between power-off callback and driver removal

[Greg KH <gregkh@linuxfoundation.org>]

On Sun, Sep 06, 2026 at 09:15:29PM +0800, Hank Yang wrote:
> tegra_nvec_remove() checks pm_power_off against nvec_power_off and
> then clears it in two separate steps:
> 
> 	if (pm_power_off == nvec_power_off)
> 		pm_power_off = NULL;
> 
> If a shutdown is triggered between the check and the clear, the
> system's power-off path can call nvec_power_off() while
> tegra_nvec_remove() is concurrently tearing down the device (freeing
> resources via mfd_remove_devices(), cancel_work_sync(), etc.),
> leading to a use-after-free on nvec_power_handle.
> 
> Use cmpxchg() to make the check-and-clear atomic, closing this race
> window.
> 
> Compile-tested (ARM, tegra_defconfig) only; I don't have access to
> Tegra Paz00 hardware to test this at runtime.
> 
> Assisted-by: Claude:claude-sonnet-5

Please read:
	https://lore.kernel.org/r/2026080354-skater-urgent-31b2@gregkh

sorry,

greg k-h