FAILED: patch "[PATCH] power: supply: ucs1002: fix use-after-free on remove" failed to apply to 5.10-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 609af0ceeaefdfa42cd01dd060b20f2e41f9a232
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090327-abiding-enamel-2481@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 609af0ceeaefdfa42cd01dd060b20f2e41f9a232 Mon Sep 17 00:00:00 2001
From: Fan Wu <[email protected]>
Date: Sun, 2 Aug 2026 05:12:49 +0000
Subject: [PATCH] power: supply: ucs1002: fix use-after-free on remove
ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the health_poll delayed work, and the work reschedules itself while the chip reports a bad-health condition. devm frees the alert IRQ, which only synchronizes the handler; it does not cancel the delayed work, which can then run after devm frees the driver data and dereference it.
Register health_poll with devm_delayed_work_autocancel() before the alert IRQ is requested. devm then frees the IRQ before cancelling the work, so the handler can no longer queue it and the work is cancelled before the driver data is freed.
This issue was found by an in-house static analysis tool.
drivers/power/supply/ucs1002_power.c +5 -1
@@ -11,6 +11,7 @@#include <linux/kernel.h> #include <linux/kthread.h> #include <linux/device.h> +#include <linux/devm-helpers.h> #include <linux/module.h> #include <linux/of.h> #include <linux/of_irq.h>
@@ -640,7 +641,10 @@ static int ucs1002_probe(struct i2c_client *client) } info->health =POWER_SUPPLY_HEALTH_GOOD ; -INIT_DELAYED_WORK (&info->health_poll, ucs1002_health_poll); + ret =devm_delayed_work_autocancel (dev, &info->health_poll, + ucs1002_health_poll); +if (ret) +return ret;if (irq_a_det >0 ) { ret = devm_request_threaded_irq(dev, irq_a_det, NULL,
Sasha Levin
maintainerPATCH 1/2 workqueue: Add resource managed version of delayed work init
From: Matti Vaittinen <[email protected]>
[ Upstream commit 0341ce5443949588e93581b49b934cdde2befbf8 ]
A few drivers which need a delayed work-queue must cancel work at driver detach. Some of those implement remove() solely for this purpose. Help drivers to avoid unnecessary remove and error-branch implementation by adding managed verision of delayed work initialization. This will also help drivers to avoid mixing manual and devm based unwinding when other resources are handled by devm.
Stable-dep-of: 609af0ceeaef ("power: supply: ucs1002: fix use-after-free on remove")
--- include/linux/devm-helpers.h | 53 ++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 include/linux/devm-helpers.h
include/linux/devm-helpers.h new file +53 -0
@@ -0,0 +1,53 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +#ifndef __LINUX_DEVM_HELPERS_H +#define __LINUX_DEVM_HELPERS_H + +/* +* Functions which do automatically cancel operations or release resources upon +* driver detach. +* +* These should be helpful to avoid mixing the manual and devm-based resource +* management which can be source of annoying, rarely occurring, +* hard-to-reproduce bugs. +* +* Please take into account that devm based cancellation may be performed some +* time after the remove() is ran. +* +* Thus mixing devm and manual resource management can easily cause problems +* when unwinding operations with dependencies. IRQ scheduling a work in a queue +* is typical example where IRQs are often devm-managed and WQs are manually +* cleaned at remove(). If IRQs are not manually freed at remove() (and this is +* often the case when we use devm for IRQs) we have a period of time after +* remove() - and before devm managed IRQs are freed - where new IRQ may fire +* and schedule a work item which won't be cancelled because remove() was +* already ran. +*/ + +#include <linux/device.h> +#include <linux/workqueue.h> + +static inline void devm_delayed_work_drop (void *res) +{ +cancel_delayed_work_sync (res); +} + +/** +* devm_delayed_work_autocancel - Resource-managed work allocation +* @dev: Device which lifetime work is bound to +* @pdata: work to be cancelled when driver is detached +* +* Initialize work which is automatically cancelled when driver is detached. +* A few drivers need delayed work which must be cancelled before driver +* is detached to avoid accessing removed resources. +* devm_delayed_work_autocancel() can be used to omit the explicit +* cancelleation when driver is detached. +*/ +static inline int devm_delayed_work_autocancel (struct device *dev, +struct delayed_work *w, +work_func_t worker) +{ +INIT_DELAYED_WORK (w, worker); +return devm_add_action (dev, devm_delayed_work_drop, w); +} + +#endif
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/2 power: supply: ucs1002: fix use-after-free on remove
From: Fan Wu <[email protected]>
[ Upstream commit 609af0ceeaefdfa42cd01dd060b20f2e41f9a232 ]
ucs1002 has no remove callback, so unbind runs entirely through devm. The alert IRQ handler queues the health_poll delayed work, and the work reschedules itself while the chip reports a bad-health condition. devm frees the alert IRQ, which only synchronizes the handler; it does not cancel the delayed work, which can then run after devm frees the driver data and dereference it.
Register health_poll with devm_delayed_work_autocancel() before the alert IRQ is requested. devm then frees the IRQ before cancelling the work, so the handler can no longer queue it and the work is cancelled before the driver data is freed.
This issue was found by an in-house static analysis tool.
--- drivers/power/supply/ucs1002_power.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/power/supply/ucs1002_power.c +5 -1
@@ -12,6 +12,7 @@#include <linux/kernel.h> #include <linux/kthread.h> #include <linux/device.h> +#include <linux/devm-helpers.h> #include <linux/module.h> #include <linux/of.h> #include <linux/of_irq.h>
@@ -644,7 +645,10 @@ static int ucs1002_probe(struct i2c_client *client, } info->health =POWER_SUPPLY_HEALTH_GOOD ; -INIT_DELAYED_WORK (&info->health_poll, ucs1002_health_poll); + ret =devm_delayed_work_autocancel (dev, &info->health_poll, + ucs1002_health_poll); +if (ret) +return ret;if (irq_a_det >0 ) { ret = devm_request_threaded_irq(dev, irq_a_det, NULL,
Signature · 1 line
2.53.0