• Zheng Wang's avatar
    power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition · 47c29d69
    Zheng Wang authored
    In bq24190_probe, &bdi->input_current_limit_work is bound
    with bq24190_input_current_limit_work. When external power
    changed, it will call bq24190_charger_external_power_changed
     to start the work.
    
    If we remove the module which will call bq24190_remove to make
    cleanup, there may be a unfinished work. The possible
    sequence is as follows:
    
    CPU0                  CPUc1
    
                        |bq24190_input_current_limit_work
    bq24190_remove      |
    power_supply_unregister  |
    device_unregister   |
    power_supply_dev_release|
    kfree(psy)          |
                        |
                        | power_supply_get_property_from_supplier
                        |   //use
    
    Fix it by finishing the work before cleanup in the bq24190_remove
    
    Fixes: 97774672 ("power_supply: Initialize changed_work before calling device_add")
    Signed-off-by: default avatarZheng Wang <zyytlz.wz@163.com>
    Signed-off-by: default avatarSebastian Reichel <sebastian.reichel@collabora.com>
    47c29d69
bq24190_charger.c 55 KB