From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
To: Lee Jones <lee@kernel.org>
Cc: Binbin Zhou <zhoubinbin@loongson.cn>,
Chong Qiao <qiaochong@loongson.cn>,
Huacai Chen <chenhuacai@kernel.org>,
Corey Minyard <corey@minyard.net>,
mfd@lists.linux.dev, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH 03/28] mfd: ls2kbmc: Cancel reset work on teardown via devm_work_autocancel()
Date: Wed, 21 Oct 2026 16:59:25 +0300 [thread overview]
Message-ID: <atjFPeEWbPT6SnUr@ashevche-desk.local> (raw)
In-Reply-To: <20261021121245.3111563-3-lee@kernel.org>
On Wed, Oct 21, 2026 at 12:09:25PM +0000, Lee Jones wrote:
> ls2k_bmc_init() initialises bmc_reset_work with INIT_WORK() and
> immediately requests the PCIe and GPIO interrupts via devm_request_irq().
> If an interrupt fires and schedules bmc_reset_work before a subsequent
> step in ls2k_bmc_probe() fails, or when the device is unbound, devres
> frees ddata whilst bmc_reset_work remains queued, leading to a
> use-after-free in ls2k_bmc_events_fn().
>
> Initialise bmc_reset_work with devm_work_autocancel() before requesting
> the interrupts so that devres cancels any pending work after the
> interrupts are freed and before ddata is released.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
assuming you will add Reported-by: Sashiko...
--
With Best Regards,
Andy Shevchenko
next prev parent reply other threads:[~2026-10-21 13:59 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-21 12:09 [PATCH 01/28] mfd: nct6694: Allocate USB DMA buffers with kzalloc_obj() Lee Jones
2026-10-21 12:09 ` [PATCH 02/28] mfd: ls2kbmc: Unregister GPIO GSI via devm_add_action_or_reset() Lee Jones
2026-10-21 13:57 ` Andy Shevchenko
2026-10-21 16:34 ` Lee Jones
2026-10-21 16:50 ` Andy Shevchenko
2026-10-21 14:00 ` Andy Shevchenko
2026-10-26 3:21 ` Binbin Zhou
2026-10-21 12:09 ` [PATCH 03/28] mfd: ls2kbmc: Cancel reset work on teardown via devm_work_autocancel() Lee Jones
2026-10-21 13:59 ` Andy Shevchenko [this message]
2026-10-26 3:22 ` Binbin Zhou
2026-10-21 12:09 ` [PATCH 04/28] mfd: ls2kbmc: Allocate simplefb platform_data on the heap Lee Jones
2026-10-21 13:58 ` Andy Shevchenko
2026-10-26 4:36 ` Binbin Zhou
2026-10-21 12:09 ` [PATCH 05/28] mfd: bd96801: Allocate watchdog IRQ resource " Lee Jones
2026-10-26 6:56 ` Matti Vaittinen
2026-10-26 12:18 ` Lee Jones
2026-10-21 12:09 ` [PATCH 06/28] mfd: ti_am335x_tscadc: Retrieve parent driver data via dev_get_drvdata() Lee Jones
2026-10-21 12:09 ` [PATCH 07/28] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static Lee Jones
2026-10-21 23:41 ` Linus Walleij
2026-10-21 12:09 ` [PATCH 08/28] mfd: nct6694: Do not resubmit interrupt URB on endpoint stall (-EPIPE) Lee Jones
2026-10-21 12:09 ` [PATCH 09/28] mfd: cgbc: Zero-initialise version buffer in cgbc_get_version() Lee Jones
2026-10-21 16:38 ` Thomas Richard (congatec GmbH)
2026-10-21 17:18 ` Thomas Richard (congatec GmbH)
2026-10-21 12:09 ` [PATCH 10/28] mfd: ioc3: Request parent IRQ via request_irq() and free before domain removal Lee Jones
2026-10-21 12:09 ` [PATCH 11/28] mfd: intel-lpss: Remove registered MFD child devices on probe failure Lee Jones
2026-10-21 14:01 ` Andy Shevchenko
2026-10-21 16:33 ` Lee Jones
2026-10-21 16:49 ` Andy Shevchenko
2026-10-21 17:01 ` Andy Shevchenko
2026-10-21 12:09 ` [PATCH 12/28] mfd: max8907: Manage power-off handler via devm_register_sys_off_handler() Lee Jones
2026-10-21 12:09 ` [PATCH 13/28] mfd: twl-core: Clear pm_power_off callback in twl_remove() Lee Jones
2026-10-21 12:09 ` [PATCH 14/28] mfd: twl-core: Clear twl_priv pointer on teardown and probe failure Lee Jones
2026-10-21 12:09 ` [PATCH 15/28] mfd: loongson-se: Check return value of dma_set_mask_and_coherent() Lee Jones
2026-10-26 9:25 ` Qunqin Zhao
2026-10-21 12:09 ` [PATCH 16/28] mfd: loongson-se: Zero-initialise controller command structures Lee Jones
2026-10-26 9:32 ` Qunqin Zhao
2026-10-21 12:09 ` [PATCH 17/28] mfd: loongson-se: Reinitialise completions and wait uninterruptibly for commands Lee Jones
2026-10-27 2:40 ` Qunqin Zhao
2026-10-21 12:09 ` [PATCH 18/28] mfd: loongson-se: Zero-allocate driver data and initialise engine completions in probe Lee Jones
2026-10-27 2:43 ` Qunqin Zhao
2026-10-21 12:09 ` [PATCH 19/28] mfd: loongson-se: Prevent out-of-bounds engine access in se_irq_handler() Lee Jones
2026-10-27 2:47 ` Qunqin Zhao
2026-10-21 12:09 ` [PATCH 20/28] mfd: loongson-se: Stop controller and mask interrupts on teardown and shutdown Lee Jones
2026-10-27 3:56 ` Qunqin Zhao
2026-10-21 12:09 ` [PATCH 21/28] mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ registration Lee Jones
2026-10-27 3:25 ` Qunqin Zhao
2026-10-21 12:09 ` [PATCH 22/28] mfd: abx500-core: Unregister device ops on devm release Lee Jones
2026-10-21 23:42 ` Linus Walleij
2026-10-21 12:09 ` [PATCH 23/28] mfd: ab8500-core: Register sysfs attribute groups via devm_device_add_group() Lee Jones
2026-10-21 23:41 ` Linus Walleij
2026-10-21 12:09 ` [PATCH 24/28] mfd: tps65217: Manage IRQ domain teardown via devres Lee Jones
2026-10-21 12:09 ` [PATCH 25/28] mfd: mt6397: Manage IRQ domain lifecycle with devres Lee Jones
2026-10-21 12:09 ` [PATCH 26/28] mfd: mt6397: Unregister PM notifier on probe failure and unbind Lee Jones
2026-10-21 12:09 ` [PATCH 27/28] i2c: cgbc: Propagate hardware errors when polling read status Lee Jones
2026-10-23 8:43 ` Thomas Richard (congatec GmbH)
2026-10-26 14:53 ` Lee Jones
2026-10-21 12:09 ` [PATCH 28/28] mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper Lee Jones
2026-10-21 14:02 ` Andy Shevchenko
2026-10-21 16:52 ` Dmitry Torokhov
2026-10-21 19:19 ` Jonathan Cameron
2026-10-21 12:31 ` [PATCH 00/28] mfd: Assorted resource lifetime, teardown, and error-handling fixes Lee Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=atjFPeEWbPT6SnUr@ashevche-desk.local \
--to=andriy.shevchenko@linux.intel.com \
--cc=chenhuacai@kernel.org \
--cc=corey@minyard.net \
--cc=lee@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mfd@lists.linux.dev \
--cc=qiaochong@loongson.cn \
--cc=stable@vger.kernel.org \
--cc=zhoubinbin@loongson.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.