[PATCH 0/4] usb: stop timers/works left armed on teardown

[Chengyu Liu <lui2012qwq@gmail.com>]

The teardown paths in these four drivers do not quiesce every producer
of asynchronous work before draining it: an interrupt handler may still
queue or re-arm a timer or work item after the cancellation, while the
corresponding object is being torn down.  In three of them the IRQ is
devm-managed and freed only at detach, after remove() returns; in musb
the plain free_irq() happens later in the same remove path.  Either way
a late interrupt re-arms the callback, which then runs on freed memory:

  [1/4] musb core: musb_stage0_irq() can schedule irq_work while
        handling stage-0 USB interrupts, and the work can also re-arm
        itself from the session recheck path; musb_remove() cancels it
        before masking the interrupts and before free_irq().
  [2/4] musb dsps glue: the devm VBUS interrupt outlives the child
        teardown that deletes musb->dev_timer; its handler re-arms
        the timer via dsps_mod_timer().
  [3/4] r8a66597: r8a66597_remove() deletes the timer while the devm
        IRQ can still re-arm it from the VBINT path.
  [4/4] gpio-vbus: gpio_vbus_remove() cancels the work while the devm
        GPIO interrupt can still re-arm it (100 ms debounce delay).

Two further instances of this defect class found in the same sweep -
pch_udc and lpc32xx_udc - are being handled in Hyunjung Ko's
"usb: gadget: pch_udc: drain vbus GPIO works before freeing the
device" and "usb: gadget: lpc32xx_udc: drain the pullup work on
removal" threads, so they are not part of this series.

Testing:
  [1-3/4] build-tested on x86_64 (COMPILE_TEST where needed); they
        require hardware we do not have, so no runtime reproducer.
  [4/4] additionally confirmed with a KASAN reproducer: the driver
        probed on a gpio-sim chip in QEMU, slab-use-after-free write
        in __run_timer_base() after unregister (5/5 runs), clean with
        the fix (0/5).  The KASAN report and the reproducer kit follow
        in this thread.

All found by static analysis.  Fixes written with AI assistance.

Chengyu Liu (4):
  usb: musb: cancel irq_work after masking interrupts in musb_remove()
  usb: musb: dsps: free the VBUS interrupt before the child teardown
  usb: gadget: r8a66597: free the IRQ before deleting the timer
  usb: phy: gpio-vbus: free the interrupt before cancelling the work

 drivers/usb/gadget/udc/r8a66597-udc.c  |  8 ++++++++
 drivers/usb/gadget/udc/r8a66597-udc.h  |  1 +
 drivers/usb/musb/musb_core.c           | 10 +++++++++-
 drivers/usb/musb/musb_dsps.c           | 11 +++++++++++
 drivers/usb/phy/phy-gpio-vbus-usb.c    |  8 ++++++++
 5 files changed, 37 insertions(+), 1 deletion(-)


Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
-- 
2.25.1