power: supply: core: fix supplied_from allocations

If dts property power-supplies has multiple values, then accessing to
psy->supplied_from[i-1] in __power_supply_populate_supplied_from will
overrun supplied_from array.

Fixes: f6e0b081fb30 ("power_supply: Populate supplied_from hierarchy from the device tree")
Signed-off-by: Lucas Tsai <lucas_tsai@richtek.com>
Link: https://patch.msgid.link/20260609114403.3896073-1-lucas_tsai@richtek.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>

diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index a446d3d086fcd235a1b20e5e6e235388f0eaa3c0..2532e221b2e1913c5978518adfe0636688794123 100644 (file)
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -292,18 +292,13 @@ static int power_supply_check_supplies(struct power_supply *psy)
        if (cnt == 1)
                return 0;
 
-       /* All supplies found, allocate char ** array for filling */
-       psy->supplied_from = devm_kzalloc(&psy->dev, sizeof(*psy->supplied_from),
+       /* All supplies found, allocate char * array for filling */
+       psy->supplied_from = devm_kcalloc(&psy->dev,
+                                         cnt - 1, sizeof(*psy->supplied_from),
                                          GFP_KERNEL);
        if (!psy->supplied_from)
                return -ENOMEM;
 
-       *psy->supplied_from = devm_kcalloc(&psy->dev,
-                                          cnt - 1, sizeof(**psy->supplied_from),
-                                          GFP_KERNEL);
-       if (!*psy->supplied_from)
-               return -ENOMEM;
-
        return power_supply_populate_supplied_from(psy);
 }
 #else