From: sashiko-bot@kernel.org
To: "Danish Khateeb" <danishkhateeb03@gmail.com>
Cc: lee@kernel.org, linux-leds@vger.kernel.org
Subject: Re: [PATCH] leds: tca6507: Fix use-after-free on unbind
Date: Sat, 26 Sep 2026 17:26:38 +0000 [thread overview]
Message-ID: <20260926172639.30A8F1F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260926172115.543800-1-danishkhateeb03@gmail.com>
> Since the LEDs are registered with devm_led_classdev_register(), they
> are unregistered only after tca6507_remove() has cancelled the work.
> Unregistering an LED that is on turns it off, which queues the work
> again from led_assign(), and the work then runs after devres has freed
> the chip:
>
> BUG: KASAN: slab-use-after-free in assign_work+0x414/0x5b0
> Read of size 8 at addr ffff888010d5c0c0 by task kworker/1:2/65
> ...
> Last potentially related work creation:
> ...
> queue_work_on+0xb6/0xc0
> led_assign+0x223/0x340 [leds_tca6507]
> led_classdev_unregister+0x26b/0x340
> release_nodes+0xb3/0x140
> devres_release_group+0x247/0x470
> i2c_device_remove+0xbf/0x1b0
>
> Set up the work with devm_work_autocancel() before the LEDs are
> registered, so that devres cancels it after they are gone, and drop
> tca6507_remove().
>
> Fixes: 1b5c2fa7081c ("leds: tca6507: Use devm_led_classdev_register() to simplify remove path")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260926172115.543800-1-danishkhateeb03@gmail.com?part=1
next prev parent reply other threads:[~2026-09-26 17:26 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-26 17:21 [PATCH] leds: tca6507: Fix use-after-free on unbind Danish Khateeb
2026-09-26 17:26 ` sashiko-bot [this message]
2026-09-29 15:55 ` Andrew Davis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260926172639.30A8F1F000FF@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=danishkhateeb03@gmail.com \
--cc=lee@kernel.org \
--cc=linux-leds@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox