[PATCH] usb: typec: tcpci: free IRQ before unregistering TCPM port

[PATCH] usb: typec: tcpci: free IRQ before unregistering TCPM port

[Yaohan Li]

tcpci_remove() unregisters the TCPM port before the managed threaded
IRQ has been released. The IRQ handler can still queue work on the
TCPM port worker after unregister has destroyed that worker, causing
a use-after-free.

Free and synchronize the managed IRQ before calling
tcpci_unregister_port(). This ensures no new alert callback can
queue work after the TCPM worker has been torn down.

A KASAN test using a simulated I2C TCPCI device reproduced the
race while unregistering the port. The corresponding teardown
sequence produced no report after the change.

Fixes: ae8a2ca8a2215 ("usb: typec: Group all TCPCI/TCPM code together")
Assisted-by: ZCode:GLM-4
Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
---
 drivers/usb/typec/tcpm/tcpci.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
index 6717ac914c6a6..580dd5256d0a3 100644
--- a/drivers/usb/typec/tcpm/tcpci.c
+++ b/drivers/usb/typec/tcpm/tcpci.c
@@ -993,6 +993,15 @@ static void tcpci_remove(struct i2c_client *client)
 	if (err < 0)
 		dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err));
 
+	/*
+	 * The port's kthread worker is freed by tcpci_unregister_port()
+	 * below, and the threaded IRQ handler queues work on it without
+	 * any port-registered check. Free the IRQ (which also waits for
+	 * an in-flight handler) before the port is unregistered: the devm
+	 * cleanup would only run after .remove() has returned.
+	 */
+	devm_free_irq(&client->dev, client->irq, chip);
+
 	tcpci_unregister_port(chip->tcpci);
 }
 
-- 
2.34.1

Re: [PATCH] usb: typec: tcpci: free IRQ before unregistering TCPM port

[sashiko-bot]

> tcpci_remove() unregisters the TCPM port before the managed threaded
> IRQ has been released. The IRQ handler can still queue work on the
> TCPM port worker after unregister has destroyed that worker, causing
> a use-after-free.
> 
> Free and synchronize the managed IRQ before calling
> tcpci_unregister_port(). This ensures no new alert callback can
> queue work after the TCPM worker has been torn down.
> 
> A KASAN test using a simulated I2C TCPCI device reproduced the
> race while unregistering the port. The corresponding teardown
> sequence produced no report after the change.
> 
> Fixes: ae8a2ca8a2215 ("usb: typec: Group all TCPCI/TCPM code together")
> Assisted-by: ZCode:GLM-4
> Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179378589227.74015.8259496684787732118@gmail.com?part=1