• Hans de Goede's avatar
    power: supply: ab8500: Fix external_power_changed race · a5299ce4
    Hans de Goede authored
    ab8500_btemp_external_power_changed() dereferences di->btemp_psy,
    which gets sets in ab8500_btemp_probe() like this:
    
            di->btemp_psy = devm_power_supply_register(dev, &ab8500_btemp_desc,
                                                       &psy_cfg);
    
    As soon as devm_power_supply_register() has called device_add()
    the external_power_changed callback can get called. So there is a window
    where ab8500_btemp_external_power_changed() may get called while
    di->btemp_psy has not been set yet leading to a NULL pointer dereference.
    
    Fixing this is easy. The external_power_changed callback gets passed
    the power_supply which will eventually get stored in di->btemp_psy,
    so ab8500_btemp_external_power_changed() can simply directly use
    the passed in psy argument which is always valid.
    
    And the same applies to ab8500_fg_external_power_changed().
    Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
    Reviewed-by: default avatarLinus Walleij <linus.walleij@linaro.org>
    Signed-off-by: default avatarSebastian Reichel <sebastian.reichel@collabora.com>
    a5299ce4
ab8500_fg.c 84.1 KB