• Hans de Goede's avatar
    power: supply: sc27xx: Fix external_power_changed race · 4d5c129d
    Hans de Goede authored
    sc27xx_fgu_external_power_changed() dereferences data->battery,
    which gets sets in ab8500_btemp_probe() like this:
    
    	data->battery = devm_power_supply_register(dev, &sc27xx_fgu_desc,
                                                       &fgu_cfg);
    
    As soon as devm_power_supply_register() has called device_add()
    the external_power_changed callback can get called. So there is a window
    where sc27xx_fgu_external_power_changed() may get called while
    data->battery has not been set yet leading to a NULL pointer dereference.
    
    Fixing this is easy. The external_power_changed callback gets passed
    the power_supply which will eventually get stored in data->battery,
    so sc27xx_fgu_external_power_changed() can simply directly use
    the passed in psy argument which is always valid.
    
    After this change sc27xx_fgu_external_power_changed() is reduced to just
    "power_supply_changed(psy);" and it has the same prototype. While at it
    simply replace it with making the external_power_changed callback
    directly point to power_supply_changed.
    
    Cc: Orson Zhai <orsonzhai@gmail.com>
    Cc: Chunyan Zhang <zhang.lyra@gmail.com>
    Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
    Reviewed-by: default avatarBaolin Wang <baolin.wang@linux.alibaba.com>
    Signed-off-by: default avatarSebastian Reichel <sebastian.reichel@collabora.com>
    4d5c129d
sc27xx_fuel_gauge.c 34.5 KB