• Krzysztof Kozlowski's avatar
    power_supply: Fix possible NULL pointer dereference on early uevent · 7f1a57fd
    Krzysztof Kozlowski authored
    Don't call the power_supply_changed() from power_supply_register() when
    parent is still probing because it may lead to accessing parent too
    early.
    
    In bq27x00_battery this caused NULL pointer exception because uevent of
    power_supply_changed called back the the get_property() method provided
    by the driver. The get_property() method accessed pointer which should
    be returned by power_supply_register().
    
    Starting from bq27x00_battery_probe():
      di->bat = power_supply_register()
        power_supply_changed()
          kobject_uevent()
            power_supply_uevent()
              power_supply_show_property()
                power_supply_get_property()
                  bq27x00_battery_get_property()
                    dereference of di->bat which is NULL here
    
    The dereference of di->bat (value returned by power_supply_register())
    is the currently visible problem. However calling back the methods
    provided by driver before ending the probe may lead to accessing other
    driver-related data which is not yet initialized.
    
    The call to power_supply_changed() is postponed till probing ends -
    mutex of parent device is released.
    Reported-by: default avatarH. Nikolaus Schaller <hns@goldelico.com>
    Signed-off-by: default avatarKrzysztof Kozlowski <k.kozlowski@samsung.com>
    Fixes: 297d716f ("power_supply: Change ownership from driver to core")
    Tested-By: default avatarDr. H. Nikolaus Schaller <hns@goldelico.com>
    Signed-off-by: default avatarSebastian Reichel <sre@kernel.org>
    7f1a57fd
power_supply_core.c 24.2 KB