power: supply: rt9455: quiesce delayed work before teardown

The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself.

rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work after it has already been cancelled:

rt9455_remove() workqueue
cancel pwr_rdy_work
cancel max_charging_time_work
batt_presence_work queues
max_charging_time_work
cancel batt_presence_work
return
devres frees rt9455_info
max_charging_time_work dereferences
rt9455_info

The IRQ also remains registered until devres cleanup and can queue more work after any of the cancellation calls. If rt9455_hw_init() fails after the IRQ has been requested, probe returns without cancelling work that may already have been queued. A pending callback can then access rt9455_info after it has been freed.

Explicitly free the managed IRQ before cancelling the delayed works in both paths. This waits for the threaded handler and prevents it from queuing more work. Cancel pwr_rdy_work and batt_presence_work before max_charging_time_work because both can queue the latter.

This issue was found by an in-house static analysis tool.

Fixes e86d69dd786e ("power_supply: Add support for Richtek RT9455 battery charger")

Cc [email protected]

Assisted-by Codex:gpt-5.6

Signed-off-by Fan Wu <[email protected]>

---
 drivers/power/supply/rt9455_charger.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

drivers/power/supply/rt9455_charger.c +11 -0

index 7045d2908148..3c64591b5934 100644
@@ -1582,6 +1582,17 @@ static const struct regmap_config rt9455_regmap_config = {
 	.cache_type	= REGCACHE_MAPLE,
 };
 
+static void rt9455_cancel_all_delayed_works(struct rt9455_info *info)
+{
+	/*
+	 * Both pwr_rdy_work and batt_presence_work can queue
+	 * max_charging_time_work, so cancel them first.
+	 */
+	cancel_delayed_work_sync(&info->pwr_rdy_work);
+	cancel_delayed_work_sync(&info->batt_presence_work);
+	cancel_delayed_work_sync(&info->max_charging_time_work);
+}
+
 static int rt9455_probe(struct i2c_client *client)
 {
 	struct i2c_adapter *adapter = client->adapter;

@@ -1684,11 +1695,15 @@ static int rt9455_probe(struct i2c_client *client)
 	ret = rt9455_hw_init(info, ichrg, ieoc_percentage, mivr, iaicr);
 	if (ret) {
 		dev_err(dev, "Failed to set charger to its default values\n");

drivers/power/supply/rt9455_charger.c +4 -4

 put_usb_notifier:
 #if IS_ENABLED(CONFIG_USB_PHY)
 	if (info->nb.notifier_call)  {

@@ -1704,6 +1719,10 @@ static void rt9455_remove(struct i2c_client *client)
 	int ret;
 	struct rt9455_info *info = i2c_get_clientdata(client);
 
+	/* Stop the IRQ handler from queuing work during teardown. */
+	devm_free_irq(&client->dev, client->irq, info);
+	rt9455_cancel_all_delayed_works(info);
+
 	ret = rt9455_register_reset(info);
 	if (ret)
 		dev_err(&info->client->dev, "Failed to set charger to its default values\n");

@@ -1712,10 +1731,6 @@ static void rt9455_remove(struct i2c_client *client)
 	if (info->nb.notifier_call)
 		usb_unregister_notifier(info->usb_phy, &info->nb);
 #endif
-
-	cancel_delayed_work_sync(&info->pwr_rdy_work);
-	cancel_delayed_work_sync(&info->max_charging_time_work);
-	cancel_delayed_work_sync(&info->batt_presence_work);
 }
 
 static const struct i2c_device_id rt9455_i2c_id_table[] = {

Signature · 1 line

2.34.1

The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself.

rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work after it has already been cancelled:

[...]

The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_work and batt_presence_work can also queue max_charging_time_work, while batt_presence_work can requeue itself.

rt9455_remove() cancels max_charging_time_work before batt_presence_work. The latter can therefore queue max_charging_time_work after it has already been cancelled:

[...]