Thread (2 messages) 2 messages, 2 authors, 2021-10-31
STALE1686d

[PATCH] power: supply: bq27xxx: Fix kernel crash on IRQ handler register error

From: Hans de Goede <hidden>
Date: 2021-10-31 09:02:16
Also in: linux-acpi, platform-driver-x86
Subsystem: nokia n900 power supply drivers, power supply class/subsystem and drivers, the rest, ti bq27xxx power supply driver · Maintainers: Sebastian Reichel, Linus Torvalds

When registering the IRQ handler fails, do not just return the error code,
this will free the devm_kalloc-ed data struct while leaving the queued
work queued and the registered power_supply registered with both of them
now pointing to free-ed memory, resulting in various kernel crashes
soon afterwards.

Instead properly tear-down things on IRQ handler register errors.

Fixes: 703df6c09795 ("power: bq27xxx_battery: Reorganize I2C into a module")
Cc: Andrew F. Davis <redacted>
Signed-off-by: Hans de Goede <redacted>
---
 drivers/power/supply/bq27xxx_battery_i2c.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c
index 46f078350fd3..cf38cbfe13e9 100644
--- a/drivers/power/supply/bq27xxx_battery_i2c.c
+++ b/drivers/power/supply/bq27xxx_battery_i2c.c
@@ -187,7 +187,8 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client,
 			dev_err(&client->dev,
 				"Unable to register IRQ %d error %d\n",
 				client->irq, ret);
-			return ret;
+			bq27xxx_battery_teardown(di);
+			goto err_failed;
 		}
 	}
 
-- 
2.31.1
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help