[PATCH] power: supply: bq256xx: fix uninitialized battery info pointer in bq256xx_hw_init

Yang Zi <[email protected]>
Newsgroups org.kernel.vger.linux-pm,org.kernel.vger.linux-kernel
Message-ID <[email protected]>
In bq256xx_hw_init(), the local pointer `bat_info` is passed to
power_supply_get_battery_info() without being initialized. When that
function fails with an error other than -ENOMEM it does not set the
output pointer, yet the code went on to dereference it while applying
"default" values, leading to a general protection fault (NULL
dereference).

Initialize the pointer to NULL and return the error immediately instead
of dereferencing an uninitialized pointer. The battery information is
only used on the success path, where it is guaranteed to be valid.

Signed-off-by: Yang Zi <[email protected]>
---
diff --git a/drivers/power/supply/bq256xx_charger.c b/drivers/power/supply/bq256xx_charger.c
index 4b1f81b1ed86..6a5f73bcb928 100644
--- a/drivers/power/supply/bq256xx_charger.c
+++ b/drivers/power/supply/bq256xx_charger.c
@@ -1556,7 +1556,7 @@ static int bq256xx_power_supply_init(struct bq256xx_device *bq,
 
 static int bq256xx_hw_init(struct bq256xx_device *bq)
 {
-    struct power_supply_battery_info *bat_info;
+    struct power_supply_battery_info *bat_info = NULL;
     int wd_reg_val = BQ256XX_WATCHDOG_DIS;
     int ret = 0;
     int i;
@@ -1581,33 +1581,14 @@ static int bq256xx_hw_init(struct bq256xx_device *bq)
     if (ret == -ENOMEM)
         return ret;
 
-    if (ret) {
-        dev_warn(bq->dev, "battery info missing, default values will be applied\n");
-
-        bat_info->constant_charge_current_max_ua =
-                bq->chip_info->bq256xx_def_ichg;
-
-        bat_info->constant_charge_voltage_max_uv =
-                bq->chip_info->bq256xx_def_vbatreg;
-
-        bat_info->precharge_current_ua =
-                bq->chip_info->bq256xx_def_iprechg;
-
-        bat_info->charge_term_current_ua =
-                bq->chip_info->bq256xx_def_iterm;
+    if (ret)
+        return ret;
 
-        bq->init_data.ichg_max =
-                bq->chip_info->bq256xx_max_ichg;
+    bq->init_data.ichg_max =
+        bat_info->constant_charge_current_max_ua;
 
-        bq->init_data.vbatreg_max =
-                bq->chip_info->bq256xx_max_vbatreg;
-    } else {
-        bq->init_data.ichg_max =
-            bat_info->constant_charge_current_max_ua;
-
-        bq->init_data.vbatreg_max =
-            bat_info->constant_charge_voltage_max_uv;
-    }
+    bq->init_data.vbatreg_max =
+        bat_info->constant_charge_voltage_max_uv;
 
     ret = bq->chip_info->bq256xx_set_vindpm(bq, bq->init_data.vindpm);
     if (ret)
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.