github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-24 15:12:13 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()

Browse Source 
In `probe()`, `request_irq()` is called before allocating/registering a
`power_supply` handle. If an interrupt is fired between the call to
`request_irq()` and `power_supply_register()`, the `power_supply` handle
will be used uninitialized in `power_supply_changed()` in
`wm97xx_bat_update()` (triggered from the interrupt handler). This will
lead to a `NULL` pointer dereference since

Fix this racy `NULL` pointer dereference by making sure the IRQ is
requested _after_ the registration of the `power_supply` handle. Since
the IRQ is the last thing requests in the `probe()` now, remove the
error path for freeing it. Instead add one for unregistering the
`power_supply` handle when IRQ request fails.

Fixes: 7c87942aef ("wm97xx_battery: Use irq to detect charger state")
Signed-off-by: Waqar Hameed <waqar.hameed@axis.com>
Link: https://patch.msgid.link/97b55f0479a932eea7213844bf66f28a974e27a2.1766270196.git.waqar.hameed@axis.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
This commit is contained in:
Waqar Hameed 2025-12-20 23:46:24 +01:00 committed by Sebastian Reichel
parent 04aa3d6ddd
commit 39fe0eac6d
1 changed files with 19 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
drivers/power/supply/wm97xx_battery.c
View File

@ -178,12 +178,6 @@ static int wm97xx_bat_probe(struct platform_device *dev)
"failed to get charge GPIO\n");
if (charge_gpiod) {
gpiod_set_consumer_name(charge_gpiod, "BATT CHRG");
ret = request_irq(gpiod_to_irq(charge_gpiod),
wm97xx_chrg_irq, 0,
"AC Detect", dev);
if (ret)
return dev_err_probe(&dev->dev, ret,
"failed to request GPIO irq\n");
props++; /* POWER_SUPPLY_PROP_STATUS */
}
@ -199,10 +193,8 @@ static int wm97xx_bat_probe(struct platform_device *dev)
props++; /* POWER_SUPPLY_PROP_VOLTAGE_MIN */
prop = kcalloc(props, sizeof(*prop), GFP_KERNEL);
if (!prop) {
ret = -ENOMEM;
goto err3;
}
if (!prop)
return -ENOMEM;
prop[i++] = POWER_SUPPLY_PROP_PRESENT;
if (charge_gpiod)
@ -236,15 +228,27 @@ static int wm97xx_bat_probe(struct platform_device *dev)
schedule_work(&bat_work);
} else {
ret = PTR_ERR(bat_psy);
goto err4;
goto free;
}
if (charge_gpiod) {
ret = request_irq(gpiod_to_irq(charge_gpiod), wm97xx_chrg_irq,
0, "AC Detect", dev);
if (ret) {
dev_err_probe(&dev->dev, ret,
"failed to request GPIO irq\n");
goto unregister;
}
}
return 0;
err4:
unregister:
power_supply_unregister(bat_psy);
free:
kfree(prop);
err3:
if (charge_gpiod)
free_irq(gpiod_to_irq(charge_gpiod), dev);
return ret;
}