Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1a0b1cc3 authored by Umang Agrawal's avatar Umang Agrawal
Browse files

power: smb1390: Fix NULL pointer dereference issue 



There exists a possible NULL pointer dereference issue due
to CP_DISABLE voter callback voting for CP_AWAKE votable which
is created after the creation of CP_DISABLE voter.

Fix this by creating CP_AWAKE votable prior to creation of CP_DISABLE
votable.

Change-Id: Ia838909aee1ed58a9b0b15779e7a8f32d6991a6c
Signed-off-by: default avatarUmang Agrawal <uagrawal@codeaurora.org>
parent d96627d1

drivers/power/supply/qcom/smb1390-charger.c

+6 −5
Original line number Diff line number Diff line
@@ -690,6 +690,11 @@ static void smb1390_release_channels(struct smb1390 *chip) 


static int smb1390_create_votables(struct smb1390 *chip)

{

	chip->cp_awake_votable = create_votable("CP_AWAKE", VOTE_SET_ANY,

			smb1390_awake_vote_cb, chip);

	if (IS_ERR(chip->cp_awake_votable))

		return PTR_ERR(chip->cp_awake_votable);



	chip->disable_votable = create_votable("CP_DISABLE",

			VOTE_SET_ANY, smb1390_disable_vote_cb, chip);

	if (IS_ERR(chip->disable_votable))
@@ -700,11 +705,6 @@ static int smb1390_create_votables(struct smb1390 *chip) 
	if (IS_ERR(chip->ilim_votable))

		return PTR_ERR(chip->ilim_votable);



	chip->cp_awake_votable = create_votable("CP_AWAKE", VOTE_SET_ANY,

			smb1390_awake_vote_cb, chip);

	if (IS_ERR(chip->cp_awake_votable))

		return PTR_ERR(chip->cp_awake_votable);



	return 0;

}
@@ -712,6 +712,7 @@ static void smb1390_destroy_votables(struct smb1390 *chip) 
{

	destroy_votable(chip->disable_votable);

	destroy_votable(chip->ilim_votable);

	destroy_votable(chip->cp_awake_votable);

}



static int smb1390_init_hw(struct smb1390 *chip)

drivers/power/supply/qcom/smb5-lib.c

+2 −0
Original line number Diff line number Diff line
@@ -5457,6 +5457,8 @@ static void smblib_destroy_votables(struct smb_charger *chg) 
		destroy_votable(chg->awake_votable);

	if (chg->chg_disable_votable)

		destroy_votable(chg->chg_disable_votable);

	if (chg->wdog_snarl_irq_en_votable)

		destroy_votable(chg->wdog_snarl_irq_en_votable);

}



static void smblib_iio_deinit(struct smb_charger *chg)