Re: [PATCH v2] leds: tca6507: Fix use-after-free on unbind

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] leds: tca6507: devres cancels work before LED off commands are sent
--

commit 26c3a76d710837c5d81cb4e74292b31880a4a3d5
Author: Danish Khateeb <danishkhateeb03@gmail.com>

leds: tca6507: Fix use-after-free on unbind
    
Set up the work with devm_work_autocancel() before the LEDs are registered,
so that devres cancels it after they are gone, and drop tca6507_remove().
This resolves a previous use-after-free.

> diff --git a/drivers/leds/leds-tca6507.c b/drivers/leds/leds-tca6507.c
> index 9afe2722986cf..0f987e551f03d 100644
> --- a/drivers/leds/leds-tca6507.c
> +++ b/drivers/leds/leds-tca6507.c
[ ... ]
> @@ -735,9 +736,11 @@ static int tca6507_probe(struct i2c_client *client)
>  		return -ENOMEM;
>  
>  	tca->client = client;
> -	INIT_WORK(&tca->work, tca6507_work);
>  	spin_lock_init(&tca->lock);
> -	i2c_set_clientdata(client, tca);
> +
> +	err = devm_work_autocancel(dev, &tca->work, tca6507_work);
> +	if (err)
> +		return err;

[Severity: Medium]
Since this devres action is registered before the LEDs are registered later
in tca6507_probe(), doesn't it run after them during unbind?

When the driver is unbound, devres will first unregister the LEDs, which
sets their brightness to LED_OFF. The driver's brightness_set callback
will queue an I2C transaction via schedule_work(&tca->work).

Immediately after, devres invokes the devm_work_autocancel action, which
calls cancel_work_sync(&tca->work). Since the work is still pending, it gets
cancelled before it can run, meaning the I2C write to turn off the LEDs
never occurs.

Although this resolves the previous use-after-free, does it prevent the
LEDs from correctly turning off on teardown, causing the hardware LEDs to
physically stay on after driver unbind?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015144033.56519-1-danishkhateeb03@gmail.com?part=1