[PATCH] power: supply: cros_peripheral_charger: unregister EC notifier

[PATCH] power: supply: cros_peripheral_charger: unregister EC notifier

[Pengpeng Hou]

cros_pchg_probe() registers an EC event notifier whose callback uses the
devm-allocated charger_data via container_of().  The driver has no
remove callback and does not unregister the notifier, so the notifier
chain can retain a pointer to freed driver state after unbind or probe
cleanup.

Register a devm cleanup action immediately after the notifier is
installed so the notifier is unregistered before the driver state is
released.  Also fail probe if the notifier cannot be registered, instead
of leaving a charger device that cannot receive EC events.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/power/supply/cros_peripheral_charger.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/cros_peripheral_charger.c b/drivers/power/supply/cros_peripheral_charger.c
index f132fad288cb..155848da0e32 100644
--- a/drivers/power/supply/cros_peripheral_charger.c
+++ b/drivers/power/supply/cros_peripheral_charger.c
@@ -259,6 +259,14 @@ static int cros_ec_notify(struct notifier_block *nb,
 	return cros_pchg_event(charger);
 }
 
+static void cros_pchg_unregister_notifier(void *data)
+{
+	struct charger_data *charger = data;
+
+	blocking_notifier_chain_unregister(&charger->ec_device->event_notifier,
+					   &charger->notifier);
+}
+
 static int cros_pchg_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -346,9 +354,10 @@ static int cros_pchg_probe(struct platform_device *pdev)
 	ret = blocking_notifier_chain_register(&ec_dev->ec_dev->event_notifier,
 					       nb);
 	if (ret < 0)
-		dev_err(dev, "Failed to register notifier (err:%d)\n", ret);
+		return dev_err_probe(dev, ret, "Failed to register notifier\n");
 
-	return 0;
+	return devm_add_action_or_reset(dev, cros_pchg_unregister_notifier,
+					charger);
 }
 
 #ifdef CONFIG_PM_SLEEP
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] power: supply: cros_peripheral_charger: unregister EC notifier

[Tzung-Bi Shih]

On Mon, Jun 15, 2026 at 02:31:05PM +0800, Pengpeng Hou wrote:
> cros_pchg_probe() registers an EC event notifier whose callback uses the
> devm-allocated charger_data via container_of().  The driver has no
> remove callback and does not unregister the notifier, so the notifier
> chain can retain a pointer to freed driver state after unbind or probe
> cleanup.
> 
> Register a devm cleanup action immediately after the notifier is
> installed so the notifier is unregistered before the driver state is
> released.  Also fail probe if the notifier cannot be registered, instead
> of leaving a charger device that cannot receive EC events.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

A possible nit is to use s/cros_peripheral_charger/cros_pchg/ in the patch
subject to leave more space for the summary.

With or without this,
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>