Re: [PATCH] usb: chipidea: core: cancel power_lost_work on removal

[sashiko-bot@kernel.org]

> ci_hdrc_resume() queues ci->power_lost_work on system resume when the
> controller lost power during suspend. The work (ci_power_lost_work)
> dereferences ci: it touches ci->irq, ci->dev and switches the role.
> 
> ci is allocated with devm_kzalloc(), so devres frees it after
> ci_hdrc_remove() returns. ci_hdrc_remove() never cancels power_lost_work,
> so a work queued by a resume just before unbind can run after ci has been
> freed and dereference freed memory -- a use-after-free.
> 
> Cancel power_lost_work at the start of ci_hdrc_remove(), before the
> devm-allocated ci is released.
> 
> Found by static analysis; not runtime-reproduced (needs a chipidea
> controller losing power across a system suspend/resume that races unbind).
> 
> Fixes: cc509b6a47e7 ("usb: chipidea: core: handle power lost in workqueue")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunjung Ko <hj351016@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110111402.2504885-1-hj351016@gmail.com?part=1