linux-kernel - [PATCH 00/11] power: supply: Fix use-after-free in power_supply

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <cover.1766268280.git.waqar.hameed@axis.com>
Date: Sat, 20 Dec 2025 23:35:58 +0100
From: Waqar Hameed <waqar.hameed@...s.com>
To: Linus Walleij <linusw@...nel.org>, Sebastian Reichel <sre@...nel.org>,
	Samuel Kayode <samkay014@...il.com>, Wenyou Yang <wenyou.yang@...el.com>,
	Ricardo Rivera-Matos <r-rivera-matos@...com>, Dan Murphy <dmurphy@...com>,
	Tony Lindgren <tony@...mide.com>, "Mike A. Chan" <mikechan@...gle.com>, Jun
 Nakajima <jun.nakajima@...el.com>, Xiaohui Xin <xiaohui.xin@...el.com>,
	Yunhong Jiang <yunhong.jiang@...el.com>, Tom Keel <thomas.keel@...el.com>,
	Frank Li <Frank.Li@....com>, Lee Jones <lee@...nel.org>, Nikita Travkin
	<nikita@...n.ru>, Anda-Maria Nicolae <anda-maria.nicolae@...el.com>,
	Krzysztof Kozlowski <krzk@...nel.org>, Phil Reid <preid@...ctromag.com.au>,
	Alan Cox <alan@...ux.intel.com>, Sheng Yang <sheng@...ux.intel.com>
CC: <linux-pm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<imx@...ts.linux.dev>
Subject: [PATCH 00/11] power: supply: Fix use-after-free in
 power_supply_changed()

The majority of the drivers in `drivers/power/supply/` do the right
thing when registering an interrupt handler and the `power_supply`
handle; namely making sure that the interrupt handler only runs while
the `power_supply` handle is valid. The drivers in this patch series do
not however. This can lead to a nasty use-after-free as thoroughly
explained in the commit message.

These were identified by grepping for `request.+irq` and
`power_supply_changed\(`, and then manually inspecting and fixing the
affected ones. This issue was found when writing a new driver for the
upcoming TI BQ25630 [1]. Patch adding support for that one will be sent
as soon as TI releases the datasheet publicly, which should be anytime
soon...

[1] https://www.ti.com/product/BQ25630

Waqar Hameed (11):
  power: supply: ab8500: Fix use-after-free in power_supply_changed()
  power: supply: act8945a: Fix use-after-free in power_supply_changed()
  power: supply: bq256xx: Fix use-after-free in power_supply_changed()
  power: supply: bq25980: Fix use-after-free in power_supply_changed()
  power: supply: cpcap-battery: Fix use-after-free in
    power_supply_changed()
  power: supply: goldfish: Fix use-after-free in power_supply_changed()
  power: supply: pf1550: Fix use-after-free in power_supply_changed()
  power: supply: pm8916_bms_vm: Fix use-after-free in
    power_supply_changed()
  power: supply: pm8916_lbc: Fix use-after-free in
    power_supply_changed()
  power: supply: rt9455: Fix use-after-free in power_supply_changed()
  power: supply: sbs-battery: Fix use-after-free in
    power_supply_changed()

 drivers/power/supply/ab8500_charger.c   | 40 ++++++++++++-------------
 drivers/power/supply/act8945a_charger.c | 16 +++++-----
 drivers/power/supply/bq256xx_charger.c  | 12 ++++----
 drivers/power/supply/bq25980_charger.c  | 12 ++++----
 drivers/power/supply/cpcap-battery.c    |  8 ++---
 drivers/power/supply/goldfish_battery.c | 12 ++++----
 drivers/power/supply/pf1550-charger.c   | 32 ++++++++++----------
 drivers/power/supply/pm8916_bms_vm.c    | 18 +++++------
 drivers/power/supply/pm8916_lbc.c       | 18 +++++------
 drivers/power/supply/rt9455_charger.c   | 17 ++++++-----
 drivers/power/supply/sbs-battery.c      | 36 +++++++++++-----------
 11 files changed, 111 insertions(+), 110 deletions(-)


base-commit: fa084c35afa13ab07a860ef0936cd987f9aa0460
-- 
2.39.5