All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] power: supply: ds2760_battery: fix NULL pointer dereference in w1_ds2760_remove_slave()
@ 2026-08-08 21:44 Ivy Lopez
  2026-08-12 22:00 ` Sebastian Reichel
  2026-08-13  0:41 ` [PATCH v2] power: supply: ds2760_battery: convert to devm-managed workqueue and pm_notifier Ivy Lopez
  0 siblings, 2 replies; 6+ messages in thread
From: Ivy Lopez @ 2026-08-08 21:44 UTC (permalink / raw)
  To: sre; +Cc: linux-pm, linux-kernel, Ivy Lopez

w1_ds2760_add_slave()'s failure paths (di_alloc_failed, batt_failed,
workqueue_failed) are all empty labels that just return the error
code, with no explicit unwind. This works for di itself and the
registered power supply, both are devm-managed against the w1 slave
device and get cleaned up automatically. But di->monitor_wqueue and
di->pm_notifier are not devm-managed, and are only ever set up in
the success tail of the function, after the workqueue allocation and
power supply registration have both succeeded.

The w1 core's BUS_NOTIFY_ADD_DEVICE handling in w1_family_notify()
logs and returns on a failing add_slave(), but does not prevent the
w1 slave device from later being removed from the bus, which
triggers BUS_NOTIFY_DEL_DEVICE and an unconditional call to
remove_slave(). This means w1_ds2760_remove_slave() is effectively
the only failure-unwind path for a partially initialized di, and
needs to treat every field as potentially never having been set.

Currently it does not: it unconditionally calls
destroy_workqueue(di->monitor_wqueue), which crashes with a NULL
pointer dereference if add_slave() failed before or during the
workqueue allocation (e.g. on a power_supply_register() failure, as
seen when a colliding sysfs name from a misdetected slave device
causes registration to fail).

sl->family_data can also be NULL if add_slave() failed at its own
allocation, before family_data was ever set, which would crash on
the very first dereference in remove_slave().

Fix both: return early if di is NULL, and only call
destroy_workqueue() if monitor_wqueue was actually allocated.
unregister_pm_notifier() and cancel_delayed_work_sync() are safe to
call unconditionally: the former is a no-op if the notifier was
never registered, and the latter operates on the embedded
delayed_work struct, which is always validly initialized by the
time remove_slave() can run with a non-NULL di.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217832
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
 drivers/power/supply/ds2760_battery.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/ds2760_battery.c b/drivers/power/supply/ds2760_battery.c
index 142c7492c3c2..3c2433f6b5e9 100644
--- a/drivers/power/supply/ds2760_battery.c
+++ b/drivers/power/supply/ds2760_battery.c
@@ -723,9 +723,13 @@ static void w1_ds2760_remove_slave(struct w1_slave *sl)
 {
 	struct ds2760_device_info *di = sl->family_data;
 
+	if (!di)
+		return;
+
 	unregister_pm_notifier(&di->pm_notifier);
 	cancel_delayed_work_sync(&di->monitor_work);
-	destroy_workqueue(di->monitor_wqueue);
+	if (di->monitor_wqueue)
+		destroy_workqueue(di->monitor_wqueue);
 }
 
 #ifdef CONFIG_OF
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH] w1: netlink: fix spelling mistakes in comments
@ 2026-08-11  0:27 Ivy Lopez
  2026-08-12 23:57 ` [PATCH] w1: fix spelling mistakes in comments across the subsystem Ivy Lopez
  0 siblings, 1 reply; 6+ messages in thread
From: Ivy Lopez @ 2026-08-11  0:27 UTC (permalink / raw)
  To: krzk; +Cc: linux-kernel, Ivy Lopez

Correct several typos in comments: "appeneded"/"appened" ->
"appended", "Direclty" -> "Directly", "compariable" -> "comparable",
"duplicats" -> "duplicates".

No functional change.

Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
 drivers/w1/w1_netlink.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c
index e6b59d921076..ac541a8fc274 100644
--- a/drivers/w1/w1_netlink.c
+++ b/drivers/w1/w1_netlink.c
@@ -23,9 +23,9 @@ struct w1_cb_block {
 	u16 maxlen;
 	/* pointers to building up the reply message */
 	struct cn_msg *first_cn; /* fixed once the structure is populated */
-	struct cn_msg *cn; /* advances as cn_msg is appeneded */
-	struct w1_netlink_msg *msg; /* advances as w1_netlink_msg is appened */
-	struct w1_netlink_cmd *cmd; /* advances as cmds are appened */
+	struct cn_msg *cn; /* advances as cn_msg is appended */
+	struct w1_netlink_msg *msg; /* advances as w1_netlink_msg is appended */
+	struct w1_netlink_cmd *cmd; /* advances as cmds are appended */
 	struct w1_netlink_msg *cur_msg; /* currently message being processed */
 	/* copy of the original request follows */
 	struct cn_msg request_cn;
@@ -49,8 +49,8 @@ struct w1_cb_node {
  * @block: block to calculate
  *
  * Calculates the current message length including possible multiple
- * cn_msg and data, excludes the first sizeof(struct cn_msg).  Direclty
- * compariable to maxlen and usable to send the message.
+ * cn_msg and data, excludes the first sizeof(struct cn_msg).  Directly
+ * comparable to maxlen and usable to send the message.
  */
 static u16 w1_reply_len(struct w1_cb_block *block)
 {
@@ -581,7 +581,7 @@ static void w1_cn_callback(struct cn_msg *cn, struct netlink_skb_parms *nsp)
 		int size;
 		int reply_size = sizeof(*cn) + cn->len + slave_len;
 		if (cn->flags & W1_CN_BUNDLE) {
-			/* bundling duplicats some of the messages */
+			/* bundling duplicates some of the messages */
 			reply_size += 2 * cmd_count * (sizeof(struct cn_msg) +
 				sizeof(struct w1_netlink_msg) +
 				sizeof(struct w1_netlink_cmd));
-- 
2.55.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-13  0:43 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-08 21:44 [PATCH] power: supply: ds2760_battery: fix NULL pointer dereference in w1_ds2760_remove_slave() Ivy Lopez
2026-08-12 22:00 ` Sebastian Reichel
2026-08-13  0:41 ` [PATCH v2] power: supply: ds2760_battery: convert to devm-managed workqueue and pm_notifier Ivy Lopez
2026-08-13  0:41   ` [PATCH] w1: fix spelling mistakes in comments across the subsystem Ivy Lopez
2026-08-13  0:43     ` Ivy Lopez
  -- strict thread matches above, loose matches on Subject: below --
2026-08-11  0:27 [PATCH] w1: netlink: fix spelling mistakes in comments Ivy Lopez
2026-08-12 23:57 ` [PATCH] w1: fix spelling mistakes in comments across the subsystem Ivy Lopez

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.