From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C8C653264F4; Sat, 12 Sep 2026 13:47:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789220833; cv=none; b=Vry893/DApjQvJP4VmUU/SDlEimvIcsCUBFEV6PAYoYgS8v1YhCg8LkndTDpRZyYzantW0u/wpdTMoMsQlIwlnZyMj4fl/wrWD4X7jwlFnqoKYu6dlGquIlhO7zlEotWGAld6vQSBmj6Ml0BsEdD/tMjEfFi0H2mir2i2MJoFiU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789220833; c=relaxed/simple; bh=g4V4A6t6j+1wfnzrweAVxMeGv/Ka5hDs/4JdMSJ2cPU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SRrG5kuINJ592BGKUT/7zadGEWJ8duoh7z2cA9GIPS/R872QYD6A9p6qszxn5g/kGvFspzZnRKcxqA0Ok7P3KKYn0c3IGXlU4N6Evm5Zw/M3AP1XzoLyF8HFdR/w5S3FSBTZddyC7ueeK9lCAdKXarU9DkxtL32u0o5THBrlA6E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=u11HF7Cv; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="u11HF7Cv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ABF2B1F000FF; Sat, 12 Sep 2026 13:47:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789220830; bh=GzSQyrCV7IwU7sU50mY65fzZhbgw31mogobK8fj/mV4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=u11HF7CvQpQ7QcGdaBINhcvCzTjp6IqoP9NhTin8qp9K4GS9evupanQXDYyOnjQN3 YbQO4OU20Nh6NRQZYS4guK0VW1b8XTrO+UqoERWge3R+Cw0Hbx4YxwCI97KKPG62yi kaL7WmsRgGKQp2RT54406NxeZiIn7ic3KkAwYNLk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Fan Wu , Lucas Stach , Sebastian Reichel Subject: [PATCH 6.6 0215/1424] power: supply: ucs1002: fix use-after-free on remove Date: Sat, 12 Sep 2026 08:44:07 +0200 Message-ID: <20260912065612.102936939@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065607.279695368@linuxfoundation.org> References: <20260912065607.279695368@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fan Wu commit 609af0ceeaefdfa42cd01dd060b20f2e41f9a232 upstream. ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the health_poll delayed work, and the work reschedules itself while the chip reports a bad-health condition. devm frees the alert IRQ, which only synchronizes the handler; it does not cancel the delayed work, which can then run after devm frees the driver data and dereference it. Register health_poll with devm_delayed_work_autocancel() before the alert IRQ is requested. devm then frees the IRQ before cancelling the work, so the handler can no longer queue it and the work is cancelled before the driver data is freed. This issue was found by an in-house static analysis tool. Fixes: 81196e2e57fc ("power: supply: ucs1002: fix some health status issues") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu Reviewed-by: Lucas Stach Link: https://patch.msgid.link/20260802051249.424015-1-fanwu01@zju.edu.cn Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman --- drivers/power/supply/ucs1002_power.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/power/supply/ucs1002_power.c +++ b/drivers/power/supply/ucs1002_power.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -643,7 +644,10 @@ static int ucs1002_probe(struct i2c_clie } info->health = POWER_SUPPLY_HEALTH_GOOD; - INIT_DELAYED_WORK(&info->health_poll, ucs1002_health_poll); + ret = devm_delayed_work_autocancel(dev, &info->health_poll, + ucs1002_health_poll); + if (ret) + return ret; if (irq_a_det > 0) { ret = devm_request_threaded_irq(dev, irq_a_det, NULL,