Re: [PATCH v3 1/4] power: supply: Add registration init callback

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `cancel_work_sync()` on the error path of `__power_supply_register` can lead to a Use-After-Free of `psy->changed_work` if `init()` or a later registration step fails.
--

--- Patch [1]: [PATCH v3 1/4] power: supply: Add registration init callback ---
commit c4ba9fcb2726959834e20c38014a9f7e6a27b6c5
Author: Vincent Cloutier <vincent@cloutier.co>

power: supply: Add registration init callback

This patch adds an optional init callback for power supply drivers to consume
battery data before the power supply is visible. The callback runs during
registration after driver data is available but before the device is added.

> diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
> --- a/drivers/power/supply/power_supply_core.c
> +++ b/drivers/power/supply/power_supply_core.c
[ ... ]
> @@ -1624,6 +1624,14 @@ __power_supply_register(struct device *parent,
>  	init_rwsem(&psy->extensions_sem);
>  	INIT_LIST_HEAD(&psy->extensions);
>  
> +	if (desc->init) {
> +		rc = desc->init(psy);
> +		if (WARN_ON_ONCE(rc > 0))
> +			rc = -EINVAL;
> +		if (rc)
> +			goto check_supplies_failed;

[Severity: High]
This is a pre-existing issue, but this new callback makes the error handling
flaw much easier to trigger.

If a driver requests an interrupt during this init callback, and the
interrupt fires immediately, its handler might call power_supply_changed(),
which queues psy->changed_work.

If the init callback subsequently returns an error, or a later registration
step fails, the function jumps to the check_supplies_failed label:

__power_supply_register() {
    ...
check_supplies_failed:
dev_set_name_failed:
        put_device(dev);
        return ERR_PTR(rc);
}

The put_device() call drops the reference count and frees the psy object via
power_supply_dev_release(). However, there is no call to cancel_work_sync()
for psy->changed_work in this error path.

Could this lead to a use-after-free when the system workqueue executes
psy->changed_work on the freed memory?

> +	}
> +
>  	rc = device_add(dev);
>  	if (rc)
>  		goto device_add_failed;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721185904.40756-1-vincent.cloutier@icloud.com?part=1