power_supply: Fix possible NULL pointer dereference on early uevent
authorKrzysztof Kozlowski <k.kozlowski@samsung.com>
Tue, 19 May 2015 07:13:02 +0000 (16:13 +0900)
committerSebastian Reichel <sre@kernel.org>
Thu, 21 May 2015 13:41:09 +0000 (15:41 +0200)
commit7f1a57fdd6cb6e7be2ed31878a34655df38e1861
tree20413d06df4c75d7fbdb2aafab6b801808418555
parent8e59c7f23410d5ca6b350a178b861a3d68c49edf
power_supply: Fix possible NULL pointer dereference on early uevent

Don't call the power_supply_changed() from power_supply_register() when
parent is still probing because it may lead to accessing parent too
early.

In bq27x00_battery this caused NULL pointer exception because uevent of
power_supply_changed called back the the get_property() method provided
by the driver. The get_property() method accessed pointer which should
be returned by power_supply_register().

Starting from bq27x00_battery_probe():
  di->bat = power_supply_register()
    power_supply_changed()
      kobject_uevent()
        power_supply_uevent()
          power_supply_show_property()
            power_supply_get_property()
              bq27x00_battery_get_property()
                dereference of di->bat which is NULL here

The dereference of di->bat (value returned by power_supply_register())
is the currently visible problem. However calling back the methods
provided by driver before ending the probe may lead to accessing other
driver-related data which is not yet initialized.

The call to power_supply_changed() is postponed till probing ends -
mutex of parent device is released.

Reported-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core")
Tested-By: Dr. H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
drivers/power/power_supply_core.c
include/linux/power_supply.h
This page took 0.028341 seconds and 5 git commands to generate.