[PATCH v2 0/4] usb: stop timers/works left armed on teardown

[Chengyu Liu <lui2012qwq@gmail.com>]

The teardown paths in these four drivers do not quiesce every producer
of asynchronous work before draining it: an interrupt handler may still
queue or re-arm a timer or work item after the cancellation, while the
corresponding object is being torn down.  In three of them the IRQ is
devm-managed and freed only at detach, after remove() returns; in musb
the plain free_irq() happens later in the same remove path.  Either way
a late interrupt re-arms the callback, which then runs on freed memory:

  [1/4] musb core: musb_stage0_irq() can schedule irq_work (and
        finish_resume_work on remote wakeup) from interrupt context,
        irq_work can also re-arm itself from the session recheck path,
        and musb_hub_control() can arm finish_resume_work and
        deassert_reset_work until the root hub is torn down;
        musb_remove() cancelled all three too early.
  [2/4] musb dsps glue: the devm VBUS interrupt outlives the child
        teardown that deletes musb->dev_timer; its handler re-arms
        the timer via dsps_mod_timer().
  [3/4] r8a66597: r8a66597_remove() deletes the timer while the devm
        IRQ can still re-arm it from the VBINT path.
  [4/4] gpio-vbus: gpio_vbus_remove() cancels the work while the devm
        GPIO interrupt can still re-arm it (100 ms debounce delay).

Two further instances of this defect class found in the same sweep -
pch_udc and lpc32xx_udc - are being handled in Hyunjung Ko's
"usb: gadget: pch_udc: drain vbus GPIO works before freeing the
device" and "usb: gadget: lpc32xx_udc: drain the pullup work on
removal" threads, so they are not part of this series.

Testing:
  [1-3/4] build-tested on x86_64 (COMPILE_TEST where needed); they
        require hardware we do not have, so no runtime reproducer.
  [4/4] additionally confirmed with a KASAN reproducer: the driver
        probed on a gpio-sim chip in QEMU, slab-use-after-free write
        in __run_timer_base() after unregister (5/5 runs), clean with
        the fix (0/5).  The KASAN report and the reproducer kit follow
        in this thread.

All found by static analysis.  Fixes written with AI assistance.

Changelog:
v2:
- [1/4] also move the finish_resume_work and deassert_reset_work
        cancels behind the interrupt quiesce, per Neill Kapron's
        review; finish_resume_work is armed from interrupt context as
        well (musb_handle_intr_resume()), and both it and
        deassert_reset_work can additionally be re-armed via
        musb_hub_control() until musb_host_cleanup() tears the host
        down.  Suggested-by added; Fixes tag corrected to
        commit f730f205cc51 ("usb: musb: Split PM runtime between wrapper IP and musb core")
- [2-4/4] unchanged; collected Neill Kapron's Reviewed-by.
v1: https://lore.kernel.org/linux-usb/20261112160448.41566-1-lui2012qwq@gmail.com/

Chengyu Liu (4):
  usb: musb: cancel the delayed works after quiescing the interrupt
  usb: musb: dsps: free the VBUS interrupt before the child teardown
  usb: gadget: r8a66597: free the IRQ before deleting the timer
  usb: phy: gpio-vbus: free the interrupt before cancelling the work

 drivers/usb/gadget/udc/r8a66597-udc.c  |  8 ++++++++
 drivers/usb/gadget/udc/r8a66597-udc.h  |  1 +
 drivers/usb/musb/musb_core.c           | 15 ++++++++++++---
 drivers/usb/musb/musb_dsps.c           | 11 +++++++++++
 drivers/usb/phy/phy-gpio-vbus-usb.c    |  8 ++++++++
 5 files changed, 40 insertions(+), 3 deletions(-)


Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
-- 
2.25.1