[PATCH] power: supply: bq24257: fix use-after-free on remove

[PATCH] power: supply: bq24257: fix use-after-free on remove

[Fan Wu]

The STAT-pin interrupt is devm-managed, so it stays armed until the devm
cleanup that runs after remove() returns. remove() cancels
bq->iilimit_setup_work while the handler can still fire; the threaded
handler reschedules that work and dereferences bq, so the work runs
against freed memory once devm frees bq.

Call devm_free_irq() before canceling the work so the handler is quiesced
and cannot reschedule it after the cancel.

Found by static analysis.

Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/power/supply/bq24257_charger.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/power/supply/bq24257_charger.c b/drivers/power/supply/bq24257_charger.c
index 72f1bfea8d..b9110d5fe2 100644
--- a/drivers/power/supply/bq24257_charger.c
+++ b/drivers/power/supply/bq24257_charger.c
@@ -1064,6 +1064,7 @@ static void bq24257_remove(struct i2c_client *client)
 {
 	struct bq24257_device *bq = i2c_get_clientdata(client);
 
+	devm_free_irq(&client->dev, client->irq, bq);
 	if (bq->iilimit_autoset_enable)
 		cancel_delayed_work_sync(&bq->iilimit_setup_work);
 
-- 
2.34.1

Re: [PATCH] power: supply: bq24257: fix use-after-free on remove

[Sebastian Reichel]

[-- Attachment #1: Type: text/plain, Size: 1797 bytes --]

Hi,

On Fri, Jul 31, 2026 at 02:35:54PM +0000, Fan Wu wrote:
> The STAT-pin interrupt is devm-managed, so it stays armed until the devm
> cleanup that runs after remove() returns. remove() cancels
> bq->iilimit_setup_work while the handler can still fire; the threaded
> handler reschedules that work and dereferences bq, so the work runs
> against freed memory once devm frees bq.
> 
> Call devm_free_irq() before canceling the work so the handler is quiesced
> and cannot reschedule it after the cancel.
> 
> Found by static analysis.
> 
> Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
> ---

Instead of this, which renders the device managed part of the IRQ
request pointless, just make the delayed work also device
managed and thus ordered correctly:

1. Move the INIT_DELAYED_WORK() block directly before the IRQ registration
2. Replace INIT_DELAYED_WORK() with devm_delayed_work_autocancel()
3. Drop the now pointless cancel_delayed_work_sync() from remove function

Greetings,

-- Sebastian

>  drivers/power/supply/bq24257_charger.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/power/supply/bq24257_charger.c b/drivers/power/supply/bq24257_charger.c
> index 72f1bfea8d..b9110d5fe2 100644
> --- a/drivers/power/supply/bq24257_charger.c
> +++ b/drivers/power/supply/bq24257_charger.c
> @@ -1064,6 +1064,7 @@ static void bq24257_remove(struct i2c_client *client)
>  {
>  	struct bq24257_device *bq = i2c_get_clientdata(client);
>  
> +	devm_free_irq(&client->dev, client->irq, bq);
>  	if (bq->iilimit_autoset_enable)
>  		cancel_delayed_work_sync(&bq->iilimit_setup_work);
>  
> -- 
> 2.34.1
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]