From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.210.172 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794035936; b=I0elvxsFG0j/1Jc1WcGYOfQSj/b0uzjr+FYZNHQkKGUUuPsCs0+c645ehUktrRpNcfJH GGQBMIiu53zsC0eiTmg2Or/sDzQILXjEEuYC12EPUuGtJglltkyzcROY84wbdUzKKQ7nh 3y6TIN+z+wJ56ZcDzGUX6ld2Jq44G1uT6ENzgX5l4GmilYRwSAY2eeJl7piCtnAfbpsiB VHhGY7UoytgEOQDZjmpvTxyQxCFo3Jdqo9vjlpO+Ezz/tH2kqQ+CtI2a1m7rXX4Ceytmg bCRozDSRfGQS82k4vr40H6bnwXnyk2scI2bwWqB4lwKjUra5fF63kUj7ACaSLkOuNMg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794035936; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=e2RBvV6ZC2qSudUbd18r2yO6oRHwMggBhLaocYC4YVg=; b=APdRKYDPJQd3RifxQJIGDKAY/CoX7hM9U6aWJkWtCJve8DgfhapaWFlSePtQD228okN0 LROq5Zh8h9+21mzhl0OTzT/n/rTLmvp2qJn7t5akZECKzQaCIIkHlWvx001A+FJsZl1ro QrQYFBXffE7akYObq5PYEZAxYjmroC3ZB194gmD8IsFON0YLm/zp5iq80dMmLkVU74ZMZ xL3VfzKivPIM0ZWFxLIVlzo/crUcg5Y4JqXwjha1xYFK7qdssvdMJc13xSMAhX+u9WKni xcyVSbcV74tHvhCEnjLdKEe2GMfr1aqo/BxBjFn4yWEqbLmh+6uxV9ndRWsRjFzxP2g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=H75OZMkX; arc=none smtp.remote-ip=209.85.210.172 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 16BF9606A32D for ; Sat, 7 Nov 2026 07:18:55 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 16BF9606A32D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=H75OZMkX Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-8a052aff9e9so1042774b3a.0 for ; Fri, 06 Nov 2026 23:18:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794035935; x=1794640735; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=e2RBvV6ZC2qSudUbd18r2yO6oRHwMggBhLaocYC4YVg=; b=H75OZMkXSjam0NOi3FZTiMVbVJF2RYmjV9H0u/a4VttNJxAm5Sx5cn//1UR34WbQbI Fk0vCUFMXQ+zZcuOW1sSveqJXFgZcGZ3yZAHTMsbroZ3o3MmkNF1LIJMVA3HX4EFqNgR exgw9WPmdb1u58gPSC9A5Q66r+U+Uwz2fVU4tuWPJPtpTpvhaJ4AkL4LfNy1fNraTg18 vEzDRDc4CxJKXdDqwJ9Y4Od4HJvsyN9Ys0do8JWY1hXQXWW6USlEs7auSegDvFjzGGJ7 1FBbKGFbOpt+cIMypYL5W0OMGUfakv5YoYFj6BUS6i6gxHTOhO0Q4rLkyxSyA9jl6rGg IXww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794035935; x=1794640735; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=e2RBvV6ZC2qSudUbd18r2yO6oRHwMggBhLaocYC4YVg=; b=GDHsStXQgBjVos7vTrf5KYBCG+8yDUhBfuGDH3Hujy+gK8go6QLTue7fq7GGN/BQok An8htjWPmg8iUnfzSlsxvoRBdulRXSv7VUYysLvWMcz+W1ymzNP4XfyBGRdJ0eiiokHI 25VQILXGfVtEqICxzsu0y6tRqQLrxemoIGKzL+n5FRQJEis7cx9IkIxL6TFcirNXgXF9 l1MNYuE4A/XToNsqvIQ0SxjwAU+FjDC1S4zG3Iow0ILlXt2GERpz9zbu23fpdjT3Te3E kEUQ0O7G5DHU5X+GgczQwkW+BmbAI36dEhx/nIJXlejxCV56Awjs7HzwxX3XE2QnJ2ly dMRQ== X-Forwarded-Encrypted: i=1; AL+hErE+wU2XOa5qCFetJtR5UEv7LFtlw3HE1xqF/I1Hhv6rA6DeVT8vkSmE+lXTR4KcgTZC9jRCtD5Qy8Ezmw==@vger.kernel.org X-Gm-Message-State: APuU4Z9+8CBaetj3W4IIsrK9k/AlqkszvcsKwrN/Mwhe4l5aT4iVyu2K TdE8+bEc4+GDdtYU1UxMedG/82dcQAB/2gNa1vA8I/qya1aeSw2Fc1tb X-Gm-Gg: AYBFou1ONz6salq+RMMlmHOQeTBqgVdlIe4+9BZiEqi8thzmG6yQ0zDrWC0Y/nTEsa7 E9kVJPdBUgDWTJLrFRzwBu12cRDQLxbOJs6tsQkk4b9j6+iEwpKfGtQdKa3rudsMrtTQ4+KV5jQ 6hJ3sCAkzPIwJP5uXzEUH+S1jXujTWfC8aMNlSxE2B3y/j/K1zUfu4jwij28u3s0J2KaPPycsRG zPj20B+tVK5D/Qjv90UJavi8D9nMjKLy/dR3Yc30CQNR/wPDVe/k6iD4ketm4/TemCSUeyjy2+z Tgi8b0nNTzicwcTxp3hR+D71pI+0aLQKh/wvyCCkfLjQeRfzciDvJaE/50y3qxanjIdUxYBLfMx 4oqqTUOUVOQp4n69ZitL4pswxmb/qIjfSzApKt3WmHCgxfa1iVRAXxSwdyFckeBxJ9qM3pb5INV GuxaUsdpBF8pINqY9nBu/hkQpRyk6n1p9Xw8EEIfj5Eh/D/UFLtK08wXHd6OredWe6VdmW2ef8r 74Gf5fDSP8n+/wqL/mQ6//XqFM4str9cGjpQBvR3hXqdZwc0FDgA6oujFyLqxMRu6GuYHGGdLoH san6A73uJKj/33FhzNNkRMNjhCwHt95pwwjGfnpjqPRR0hJov5cYuzdERuiaBL8YGtixZw== X-Received: by 2002:a05:6a00:b82:b0:89f:450d:90f5 with SMTP id d2e1a72fcca58-8b37aca2e17mr4908542b3a.11.1794035935229; Fri, 06 Nov 2026 23:18:55 -0800 (PST) Received: from hj.. ([163.239.22.29]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8b356c287a8sm1234364b3a.3.2026.11.06.23.18.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Nov 2026 23:18:53 -0800 (PST) From: hyunjungg To: Dmitry Torokhov , linux-input@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Hyunjung Ko , stable@vger.kernel.org Subject: [PATCH] Input: lm8323 - cancel PWM works on unbind to avoid use-after-free Date: Sat, 7 Nov 2026 16:18:42 +0900 Message-ID: <20261107071843.3427985-1-hj351016@gmail.com> X-Mailer: git-send-email 2.43.0 X-Mailing-List: linux-input@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Hyunjung Ko lm8323 registers LM8323_NUM_PWMS PWM works (lm8323_pwm_work) and schedules them from the threaded IRQ handler, when a PWM ramp script completes, and from the LED brightness_set callback. The handler dereferences the containing struct lm8323_pwm and its ->chip, i.e. the struct lm8323_chip. The driver is fully device-managed and has no remove callback, and nothing ever cancels these works. struct lm8323_chip is allocated with devm_kzalloc(), so on unbind devres frees it once probe's resources are released. A PWM ramp completion interrupt arriving while a fade is in progress schedules pwm->work; free_irq() stops further interrupts but does not cancel an already queued work, and led_classdev_unregister() only flushes the LED core's own work, not this driver-private one. The queued work can therefore run after the lm8323_chip has been freed, dereferencing freed memory (use-after-free). Register the works with devm_work_autocancel() instead of INIT_WORK(). It is registered in init_pwm(), before devm_request_threaded_irq(), so on unwind devres runs free_irq() first, after which no new work can be scheduled, and then cancels each work while the lm8323_chip is still valid. The handler does not re-queue itself, the re-arming comes from the interrupt, so a single cancel drains it. Found by static analysis and code review; not runtime-reproduced (needs LM8323 keypad/PWM hardware with a fade in progress racing device unbind). Fixes: a48b2d4a0091 ("Input: introduce lm8323 keypad driver") Cc: stable@vger.kernel.org Signed-off-by: Hyunjung Ko --- drivers/input/keyboard/lm8323.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/input/keyboard/lm8323.c b/drivers/input/keyboard/lm8323.c index 8eac63b..388b790 100644 --- a/drivers/input/keyboard/lm8323.c +++ b/drivers/input/keyboard/lm8323.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include #include @@ -564,7 +565,9 @@ static int init_pwm(struct lm8323_chip *lm, int id, struct device *dev, pwm->desired_brightness = 0; pwm->running = false; pwm->enabled = false; - INIT_WORK(&pwm->work, lm8323_pwm_work); + err = devm_work_autocancel(dev, &pwm->work, lm8323_pwm_work); + if (err) + return err; mutex_init(&pwm->lock); pwm->chip = lm; -- 2.43.0