]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
power: supply: ab8500: Fix external_power_changed race
authorHans de Goede <hdegoede@redhat.com>
Sat, 15 Apr 2023 16:07:29 +0000 (18:07 +0200)
committerSebastian Reichel <sre@kernel.org>
Mon, 8 May 2023 13:03:50 +0000 (15:03 +0200)
commita5299ce4e96f3e8930e9c051b28d8093ada87b08
tree9944dc2e44c6bc2f97b68b585e6bc2ba33c28f1d
parentac9a78681b921877518763ba0e89202254349d1b
power: supply: ab8500: Fix external_power_changed race

ab8500_btemp_external_power_changed() dereferences di->btemp_psy,
which gets sets in ab8500_btemp_probe() like this:

        di->btemp_psy = devm_power_supply_register(dev, &ab8500_btemp_desc,
                                                   &psy_cfg);

As soon as devm_power_supply_register() has called device_add()
the external_power_changed callback can get called. So there is a window
where ab8500_btemp_external_power_changed() may get called while
di->btemp_psy has not been set yet leading to a NULL pointer dereference.

Fixing this is easy. The external_power_changed callback gets passed
the power_supply which will eventually get stored in di->btemp_psy,
so ab8500_btemp_external_power_changed() can simply directly use
the passed in psy argument which is always valid.

And the same applies to ab8500_fg_external_power_changed().

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
drivers/power/supply/ab8500_btemp.c
drivers/power/supply/ab8500_fg.c