]> git.ipfire.org Git - thirdparty/linux.git/commit
power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
authorWaqar Hameed <waqar.hameed@axis.com>
Fri, 23 Jan 2026 10:24:20 +0000 (11:24 +0100)
committerSebastian Reichel <sebastian.reichel@collabora.com>
Fri, 30 Jan 2026 19:55:19 +0000 (20:55 +0100)
commit23067259919663580c6f81801847cfc7bd54fd1f
treeac6e280d67a02f5a7723ea167c7ebf92cf6f96a5
parent562357a6310f79e45844c3e980d410a1e8e02ce6
power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler

Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `extcon` handle, means that the
`extcon` handle will be deallocated/unregistered _before_ the interrupt
handler (since `devm_` naturally deallocates in reverse allocation
order). This means that during removal, there is a race condition where
an interrupt can fire just _after_ the `extcon` handle has been
freed, *but* just _before_ the corresponding unregistration of the IRQ
handler has run.

This will lead to the IRQ handler calling `extcon_set_state_sync()` with
a freed `extcon` handle. Which usually crashes the system or otherwise
silently corrupts the memory...

Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `extcon` handle.

Fixes: f8d7a3d21160 ("power: supply: Add driver for pm8916 lbc")
Signed-off-by: Waqar Hameed <waqar.hameed@axis.com>
Reviewed-by: Nikita Travkin <nikita@trvn.ru>
Link: https://patch.msgid.link/e2a4cd2fcd42b6cd97d856c17c097289a2aed393.1769163273.git.waqar.hameed@axis.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
drivers/power/supply/pm8916_lbc.c