[PATCH] power: supply: act8945a: Disable status work on removal

[PATCH] power: supply: act8945a: Disable status work on removal

[Myeonghun Pak]

Clearing init_done does not synchronize with either status interrupt. A
handler can observe init_done set, be delayed, and schedule the status
work after cancel_work_sync() has returned. The work can then access the
power supply after its managed cleanup.

Use disable_work_sync() to reject subsequent queueing and drain any
existing execution. The charger allocation remains valid until both
managed IRQs have been released, so a late handler can safely attempt to
queue the disabled work.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: a09209acd6a8 ("power: supply: act8945a_charger: Add status change update support")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Compile-tested with GCC, W=1 (x86_64). No runtime testing.

 drivers/power/supply/act8945a_charger.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/act8945a_charger.c b/drivers/power/supply/act8945a_charger.c
index 7e4b087..61381d2 100644
--- a/drivers/power/supply/act8945a_charger.c
+++ b/drivers/power/supply/act8945a_charger.c
@@ -14,6 +14,7 @@
 #include <linux/power_supply.h>
 #include <linux/regmap.h>
 #include <linux/gpio/consumer.h>
+#include <linux/workqueue.h>
 
 static const char *act8945a_charger_model = "ACT8945A";
 static const char *act8945a_charger_manufacturer = "Active-semi";
@@ -641,7 +642,7 @@ static void act8945a_charger_remove(struct platform_device *pdev)
 	struct act8945a_charger *charger = platform_get_drvdata(pdev);
 
 	charger->init_done = false;
-	cancel_work_sync(&charger->work);
+	disable_work_sync(&charger->work);
 }
 
 static struct platform_driver act8945a_charger_driver = {

Re: [PATCH] power: supply: act8945a: Disable status work on removal

[Sebastian Reichel]

[-- Attachment #1: Type: text/plain, Size: 2080 bytes --]

Hi,

On Thu, Oct 15, 2026 at 10:34:33PM -0400, Myeonghun Pak wrote:
> Clearing init_done does not synchronize with either status interrupt. A
> handler can observe init_done set, be delayed, and schedule the status
> work after cancel_work_sync() has returned. The work can then access the
> power supply after its managed cleanup.
> 
> Use disable_work_sync() to reject subsequent queueing and drain any
> existing execution. The charger allocation remains valid until both
> managed IRQs have been released, so a late handler can safely attempt to
> queue the disabled work.
> 
> This issue was identified as part of our ongoing research while
> reviewing kernel code.
> 
> Fixes: a09209acd6a8 ("power: supply: act8945a_charger: Add status change update support")
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---

You should also drop the useless init_done.

Greetings,

-- Sebastian

> Compile-tested with GCC, W=1 (x86_64). No runtime testing.
> 
>  drivers/power/supply/act8945a_charger.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/power/supply/act8945a_charger.c b/drivers/power/supply/act8945a_charger.c
> index 7e4b087..61381d2 100644
> --- a/drivers/power/supply/act8945a_charger.c
> +++ b/drivers/power/supply/act8945a_charger.c
> @@ -14,6 +14,7 @@
>  #include <linux/power_supply.h>
>  #include <linux/regmap.h>
>  #include <linux/gpio/consumer.h>
> +#include <linux/workqueue.h>
>  
>  static const char *act8945a_charger_model = "ACT8945A";
>  static const char *act8945a_charger_manufacturer = "Active-semi";
> @@ -641,7 +642,7 @@ static void act8945a_charger_remove(struct platform_device *pdev)
>  	struct act8945a_charger *charger = platform_get_drvdata(pdev);
>  
>  	charger->init_done = false;
> -	cancel_work_sync(&charger->work);
> +	disable_work_sync(&charger->work);
>  }
>  
>  static struct platform_driver act8945a_charger_driver = {

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]