Re: [PATCH v2 1/2] power: supply: bq256xx: Expose VBUS state through extcon

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] This problem wasn't introduced by this patch, but an uninitialized stack pointer bat_info is dereferenced in the error path if battery info is missing.
--

commit 63c7018777c13e9b5077c305354b34365e65a932
Author: Reza Kurniawan <imkyufie@gmail.com>

power: supply: bq256xx: Expose VBUS state through extcon

Useful for USB controllers needing to sense VBUS state changes. This is
needed for devices like Xiaomi Redmi 5A (riva) that doesn't have its VBUS
session comparator wired directly to the USB connector pin to automatically
enable certain USB functions upon the presence of a USB power input.

> diff --git a/drivers/power/supply/bq256xx_charger.c b/drivers/power/supply/bq256xx_charger.c
> index 4b1f81b1ed867..454bc497b0d81 100644
> --- a/drivers/power/supply/bq256xx_charger.c
> +++ b/drivers/power/supply/bq256xx_charger.c

[ ... ]

> @@ -1743,6 +1817,12 @@ static int bq256xx_probe(struct i2c_client *client)
>  	if (!IS_ERR_OR_NULL(bq->usb3_phy))
>  		usb_register_notifier(bq->usb3_phy, &bq->usb_nb);
>  
> +	ret = bq256xx_extcon_init(bq);
> +	if (ret) {
> +		dev_err(dev, "Failed to register extcon device\n");
> +		return ret;
> +	}
> +
>  	if (client->irq) {
>  		ret = devm_request_threaded_irq(dev, client->irq, NULL,
>  						bq256xx_irq_handler_thread,

[Severity: Critical]
This isn't a bug introduced by this patch, but looking at bq256xx_hw_init()
called shortly after this block in bq256xx_probe(), is it possible for the
bat_info pointer to remain uninitialized and cause memory corruption?

If power_supply_get_battery_info() returns an error other than -ENOMEM
(such as -ENODEV when no "monitored-battery" node is defined), bat_info
remains uninitialized, but it is then dereferenced in the error handling
path:

drivers/power/supply/bq256xx_charger.c:bq256xx_hw_init() {
	struct power_supply_battery_info *bat_info;
	...
	ret = power_supply_get_battery_info(bq->charger, &bat_info);
	if (ret == -ENOMEM)
		return ret;

	if (ret) {
		dev_warn(bq->dev, "battery info missing, default values will be applied\n");

		bat_info->constant_charge_current_max_ua =
				bq->chip_info->bq256xx_def_ichg;
	...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260912-riva-usb-v2-0-997fe0171ee5@gmail.com?part=1