linux-kernel - Re: [PATCH] power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <79e7cfe8c324d580ad0189cbdd583184@trvn.ru>
Date: Fri, 23 Jan 2026 16:09:11 +0500
From: Nikita Travkin <nikita@...n.ru>
To: Waqar Hameed <waqar.hameed@...s.com>
Cc: Sebastian Reichel <sre@...nel.org>, kernel@...s.com, Sebastian Reichel
 <sebastian.reichel@...labora.com>, linux-pm@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] power: supply: pm8916_lbc: Fix use-after-free for extcon
 in IRQ handler

Waqar Hameed писал(а) 23.01.2026 15:24:
> Using the `devm_` variant for requesting IRQ _before_ the `devm_`
> variant for allocating/registering the `extcon` handle, means that the
> `extcon` handle will be deallocated/unregistered _before_ the interrupt
> handler (since `devm_` naturally deallocates in reverse allocation
> order). This means that during removal, there is a race condition where
> an interrupt can fire just _after_ the `extcon` handle has been
> freed, *but* just _before_ the corresponding unregistration of the IRQ
> handler has run.
> 
> This will lead to the IRQ handler calling `extcon_set_state_sync()` with
> a freed `extcon` handle. Which usually crashes the system or otherwise
> silently corrupts the memory...
> 
> Fix this racy use-after-free by making sure the IRQ is requested _after_
> the registration of the `extcon` handle.
> 
> Fixes: f8d7a3d21160 ("power: supply: Add driver for pm8916 lbc")
> Signed-off-by: Waqar Hameed <waqar.hameed@...s.com>
> ---
> Note that this patch is based on `for-next` branch in Sebastian
> Reichel's tree [1]. See the discussion in a previous patch series [2]
> for reason and background.
> 
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply.git/?h=for-next
> [2] https://lore.kernel.org/lkml/64d8dd3675a4e59fa32c3e0ef451f12d1f7ed18f.1766268280.git.waqar.hameed@axis.com/
> 

Reviewed-by: Nikita Travkin <nikita@...n.ru>

Thanks!
Nikita

>  drivers/power/supply/pm8916_lbc.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/power/supply/pm8916_lbc.c b/drivers/power/supply/pm8916_lbc.c
> index 3ca717d84aade..6b631012a7959 100644
> --- a/drivers/power/supply/pm8916_lbc.c
> +++ b/drivers/power/supply/pm8916_lbc.c
> @@ -327,11 +327,6 @@ static int pm8916_lbc_charger_probe(struct platform_device *pdev)
>  	if (irq < 0)
>  		return irq;
>  
> -	ret = devm_request_threaded_irq(dev, irq, NULL, pm8916_lbc_charger_state_changed_irq,
> -					IRQF_ONESHOT, "pm8916_lbc", chg);
> -	if (ret)
> -		return ret;
> -
>  	chg->edev = devm_extcon_dev_allocate(dev, pm8916_lbc_charger_cable);
>  	if (IS_ERR(chg->edev))
>  		return PTR_ERR(chg->edev);
> @@ -340,6 +335,11 @@ static int pm8916_lbc_charger_probe(struct platform_device *pdev)
>  	if (ret < 0)
>  		return dev_err_probe(dev, ret, "failed to register extcon device\n");
>  
> +	ret = devm_request_threaded_irq(dev, irq, NULL, pm8916_lbc_charger_state_changed_irq,
> +					IRQF_ONESHOT, "pm8916_lbc", chg);
> +	if (ret)
> +		return ret;
> +
>  	ret = regmap_read(chg->regmap, chg->reg[LBC_USB] + PM8916_INT_RT_STS, &tmp);
>  	if (ret)
>  		goto comm_error;
> 
> base-commit: 432b119ab8d8bf1f550c247f7fbe960e87ba6c92