From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
To: Sebastian Reichel <sre@kernel.org>,
Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>,
David Woodhouse <dwmw2@infradead.org>, Milo Kim <milo.kim@ti.com>,
linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Dmitry Artamonow <mad_soft@inbox.ru>,
Marek Belisko <marek@goldelico.com>,
Krzysztof Kozlowski <k.kozlowski@samsung.com>,
stable@vger.kernel.org
Subject: [RFT RESEND 3/4] power_supply: ipaq_micro_battery: Check return values in probe
Date: Fri, 20 Feb 2015 14:32:24 +0100 [thread overview]
Message-ID: <1424439145-16895-3-git-send-email-k.kozlowski@samsung.com> (raw)
In-Reply-To: <1424439145-16895-1-git-send-email-k.kozlowski@samsung.com>
The return values of create_singlethread_workqueue() and
power_supply_register() calls were not checked and even on error probe()
function returned 0.
1. If allocation of workqueue failed (returning NULL) then further
accesses could lead to NULL pointer dereference. The
queue_delayed_work() expects workqueue to be non-NULL.
2. If registration of power supply failed then during unbind the driver
tried to unregister power supply which was not actually registered.
This could lead to memory corruption because
power_supply_unregister() unconditionally cleans up given power
supply.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Fixes: 00a588f9d27f ("power: add driver for battery reading on iPaq h3xxx")
Cc: <stable@vger.kernel.org>
---
drivers/power/ipaq_micro_battery.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
diff --git a/drivers/power/ipaq_micro_battery.c b/drivers/power/ipaq_micro_battery.c
index 698cf1636bb8..96b15e003f3f 100644
--- a/drivers/power/ipaq_micro_battery.c
+++ b/drivers/power/ipaq_micro_battery.c
@@ -226,6 +226,7 @@ static struct power_supply micro_ac_power = {
static int micro_batt_probe(struct platform_device *pdev)
{
struct micro_battery *mb;
+ int ret;
mb = devm_kzalloc(&pdev->dev, sizeof(*mb), GFP_KERNEL);
if (!mb)
@@ -233,14 +234,30 @@ static int micro_batt_probe(struct platform_device *pdev)
mb->micro = dev_get_drvdata(pdev->dev.parent);
mb->wq = create_singlethread_workqueue("ipaq-battery-wq");
+ if (!mb->wq)
+ return -ENOMEM;
+
INIT_DELAYED_WORK(&mb->update, micro_battery_work);
platform_set_drvdata(pdev, mb);
queue_delayed_work(mb->wq, &mb->update, 1);
- power_supply_register(&pdev->dev, µ_batt_power);
- power_supply_register(&pdev->dev, µ_ac_power);
+
+ ret = power_supply_register(&pdev->dev, µ_batt_power);
+ if (ret < 0)
+ goto batt_err;
+
+ ret = power_supply_register(&pdev->dev, µ_ac_power);
+ if (ret < 0)
+ goto ac_err;
dev_info(&pdev->dev, "iPAQ micro battery driver\n");
return 0;
+
+ac_err:
+ power_supply_unregister(µ_ac_power);
+batt_err:
+ cancel_delayed_work_sync(&mb->update);
+ destroy_workqueue(mb->wq);
+ return ret;
}
static int micro_batt_remove(struct platform_device *pdev)
--
1.9.1
next prev parent reply other threads:[~2015-02-20 13:33 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-02-20 13:32 [RFT RESEND 1/4] power_supply: twl4030_madc: Check return value of power_supply_register Krzysztof Kozlowski
2015-02-20 13:32 ` [RFT RESEND 2/4] power_supply: ipaq_micro_battery: Fix leaking workqueue Krzysztof Kozlowski
2015-02-20 13:32 ` Krzysztof Kozlowski [this message]
2015-02-20 13:32 ` [RFT RESEND 4/4] power_supply: lp8788-charger: Fix leaked power supply on probe fail Krzysztof Kozlowski
2015-02-25 21:22 ` [RFT RESEND 1/4] power_supply: twl4030_madc: Check return value of power_supply_register Sebastian Reichel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1424439145-16895-3-git-send-email-k.kozlowski@samsung.com \
--to=k.kozlowski@samsung.com \
--cc=dbaryshkov@gmail.com \
--cc=dwmw2@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=mad_soft@inbox.ru \
--cc=marek@goldelico.com \
--cc=milo.kim@ti.com \
--cc=sre@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.