[PATCH] staging: nvec: fix race between power-off callback and driver removal

[PATCH] staging: nvec: fix race between power-off callback and driver removal

[Hank Yang]

tegra_nvec_remove() checks pm_power_off against nvec_power_off and
then clears it in two separate steps:

	if (pm_power_off == nvec_power_off)
		pm_power_off = NULL;

If a shutdown is triggered between the check and the clear, the
system's power-off path can call nvec_power_off() while
tegra_nvec_remove() is concurrently tearing down the device (freeing
resources via mfd_remove_devices(), cancel_work_sync(), etc.),
leading to a use-after-free on nvec_power_handle.

Use cmpxchg() to make the check-and-clear atomic, closing this race
window.

Compile-tested (ARM, tegra_defconfig) only; I don't have access to
Tegra Paz00 hardware to test this at runtime.

Assisted-by: Claude:claude-sonnet-5

Signed-off-by: Hank Yang <s950343@gmail.com>
---
 drivers/staging/nvec/nvec.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index 41cbdfdc1da6..b9ebfdf46002 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -906,8 +906,7 @@ static void tegra_nvec_remove(struct platform_device *pdev)
 	nvec_unregister_notifier(nvec, &nvec->nvec_status_notifier);
 	cancel_work_sync(&nvec->rx_work);
 	cancel_work_sync(&nvec->tx_work);
-	if (pm_power_off == nvec_power_off)
-		pm_power_off = NULL;
+	cmpxchg(&pm_power_off, nvec_power_off, NULL);
 }
 
 #ifdef CONFIG_PM_SLEEP
-- 
2.43.0

Re: [PATCH] staging: nvec: fix race between power-off callback and driver removal

[Greg KH]

On Sun, Sep 06, 2026 at 09:15:29PM +0800, Hank Yang wrote:
> tegra_nvec_remove() checks pm_power_off against nvec_power_off and
> then clears it in two separate steps:
> 
> 	if (pm_power_off == nvec_power_off)
> 		pm_power_off = NULL;
> 
> If a shutdown is triggered between the check and the clear, the
> system's power-off path can call nvec_power_off() while
> tegra_nvec_remove() is concurrently tearing down the device (freeing
> resources via mfd_remove_devices(), cancel_work_sync(), etc.),
> leading to a use-after-free on nvec_power_handle.
> 
> Use cmpxchg() to make the check-and-clear atomic, closing this race
> window.
> 
> Compile-tested (ARM, tegra_defconfig) only; I don't have access to
> Tegra Paz00 hardware to test this at runtime.
> 
> Assisted-by: Claude:claude-sonnet-5

Please read:
	https://lore.kernel.org/r/2026080354-skater-urgent-31b2@gregkh

sorry,

greg k-h