Patch "power: supply: ab8500: Fix external_power_changed race" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    power: supply: ab8500: Fix external_power_changed race

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     power-supply-ab8500-fix-external_power_changed-race.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3b6a28dcd58f92cf4ad3903346b55f4cfb36c1d9
Author: Hans de Goede <hdegoede@xxxxxxxxxx>
Date:   Sat Apr 15 18:07:29 2023 +0200

    power: supply: ab8500: Fix external_power_changed race
    
    [ Upstream commit a5299ce4e96f3e8930e9c051b28d8093ada87b08 ]
    
    ab8500_btemp_external_power_changed() dereferences di->btemp_psy,
    which gets sets in ab8500_btemp_probe() like this:
    
            di->btemp_psy = devm_power_supply_register(dev, &ab8500_btemp_desc,
                                                       &psy_cfg);
    
    As soon as devm_power_supply_register() has called device_add()
    the external_power_changed callback can get called. So there is a window
    where ab8500_btemp_external_power_changed() may get called while
    di->btemp_psy has not been set yet leading to a NULL pointer dereference.
    
    Fixing this is easy. The external_power_changed callback gets passed
    the power_supply which will eventually get stored in di->btemp_psy,
    so ab8500_btemp_external_power_changed() can simply directly use
    the passed in psy argument which is always valid.
    
    And the same applies to ab8500_fg_external_power_changed().
    
    Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Reviewed-by: Linus Walleij <linus.walleij@xxxxxxxxxx>
    Signed-off-by: Sebastian Reichel <sebastian.reichel@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/power/supply/ab8500_btemp.c b/drivers/power/supply/ab8500_btemp.c
index 0fd24577112eb..0bec8b90667c8 100644
--- a/drivers/power/supply/ab8500_btemp.c
+++ b/drivers/power/supply/ab8500_btemp.c
@@ -919,10 +919,8 @@ static int ab8500_btemp_get_ext_psy_data(struct device *dev, void *data)
  */
 static void ab8500_btemp_external_power_changed(struct power_supply *psy)
 {
-	struct ab8500_btemp *di = power_supply_get_drvdata(psy);
-
-	class_for_each_device(power_supply_class, NULL,
-		di->btemp_psy, ab8500_btemp_get_ext_psy_data);
+	class_for_each_device(power_supply_class, NULL, psy,
+			      ab8500_btemp_get_ext_psy_data);
 }
 
 /* ab8500 btemp driver interrupts and their respective isr */
diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
index 675f9d0e8471e..d0cbd7189a622 100644
--- a/drivers/power/supply/ab8500_fg.c
+++ b/drivers/power/supply/ab8500_fg.c
@@ -2380,10 +2380,8 @@ static int ab8500_fg_init_hw_registers(struct ab8500_fg *di)
  */
 static void ab8500_fg_external_power_changed(struct power_supply *psy)
 {
-	struct ab8500_fg *di = power_supply_get_drvdata(psy);
-
-	class_for_each_device(power_supply_class, NULL,
-		di->fg_psy, ab8500_fg_get_ext_psy_data);
+	class_for_each_device(power_supply_class, NULL, psy,
+			      ab8500_fg_get_ext_psy_data);
 }
 
 /**



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux