[PATCH 5.10/5.15 0/2] power: supply: Fix supplied_from allocation

[PATCH 5.10/5.15 0/2] power: supply: Fix supplied_from allocation

[Mikhail Dmitrichenko]

Please apply this series to 5.10.y and 5.15.y to fix CVE-2026-74271.

When a Device Tree power-supplies property lists more than one supplier,
power_supply_check_supplies() allocates space for only one pointer in
psy->supplied_from. The subsequent allocation through *psy->supplied_from
does not extend that array, and populating the second supplier writes
past its end. Patch 2 allocates a single array large enough for all the
supplier pointers.

Patch 1, upstream commit 966f6551173a ("power: supply: Fix typo in
power_supply_check_supplies"), adjusts the sizeof expressions used by
these allocations. With this small prerequisite in place, the fix in
ba61aed9a346 ("power: supply: core: fix supplied_from allocations")
applies unchanged to both branches. The fix is already in 6.1.y and
newer stable branches.

The series applies cleanly to v5.10.273 and v5.15.224.
Build-tested only.

Schspa Shi (1):
  power: supply: Fix typo in power_supply_check_supplies

Lucas Tsai (1):
  power: supply: core: fix supplied_from allocations

 drivers/power/supply/power_supply_core.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

-- 
2.43.0

[PATCH 5.10/5.15 1/2] power: supply: Fix typo in power_supply_check_supplies

[Mikhail Dmitrichenko]

From: Schspa Shi <schspa@gmail.com>

commit 966f6551173ac46183db6621451702a7e4a3d4b5 upstream.

It seems to be a typo, there is no actual BUG, but it's better to
fix it to avoid any possible BUG after we change the type of
supplied_from.

Signed-off-by: Schspa Shi <schspa@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Stable-dep-of: ba61aed9a346 ("power: supply: core: fix supplied_from allocations")
Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
---
Prerequisite for the CVE-2026-74271 fix.

 drivers/power/supply/power_supply_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index 61ba2b343b93..d63cd225d4d4 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -261,13 +261,13 @@ static int power_supply_check_supplies(struct power_supply *psy)
 		return 0;
 
 	/* All supplies found, allocate char ** array for filling */
-	psy->supplied_from = devm_kzalloc(&psy->dev, sizeof(psy->supplied_from),
+	psy->supplied_from = devm_kzalloc(&psy->dev, sizeof(*psy->supplied_from),
 					  GFP_KERNEL);
 	if (!psy->supplied_from)
 		return -ENOMEM;
 
 	*psy->supplied_from = devm_kcalloc(&psy->dev,
-					   cnt - 1, sizeof(char *),
+					   cnt - 1, sizeof(**psy->supplied_from),
 					   GFP_KERNEL);
 	if (!*psy->supplied_from)
 		return -ENOMEM;
-- 
2.43.0

[PATCH 5.10/5.15 2/2] power: supply: core: fix supplied_from allocations

[Mikhail Dmitrichenko]

From: Lucas Tsai <lucas_tsai@richtek.com>

commit ba61aed9a34671222d1149acfc2f0179a9ce7e80 upstream.

If dts property power-supplies has multiple values, then accessing to
psy->supplied_from[i-1] in __power_supply_populate_supplied_from will
overrun supplied_from array.

Fixes: f6e0b081fb30 ("power_supply: Populate supplied_from hierarchy from the device tree")
Signed-off-by: Lucas Tsai <lucas_tsai@richtek.com>
Link: https://patch.msgid.link/20260609114403.3896073-1-lucas_tsai@richtek.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
---
Backport fix for CVE-2026-74271

 drivers/power/supply/power_supply_core.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
index d63cd225d4d4..b6ade977d63c 100644
--- a/drivers/power/supply/power_supply_core.c
+++ b/drivers/power/supply/power_supply_core.c
@@ -260,18 +260,13 @@ static int power_supply_check_supplies(struct power_supply *psy)
 	if (cnt == 1)
 		return 0;
 
-	/* All supplies found, allocate char ** array for filling */
-	psy->supplied_from = devm_kzalloc(&psy->dev, sizeof(*psy->supplied_from),
+	/* All supplies found, allocate char * array for filling */
+	psy->supplied_from = devm_kcalloc(&psy->dev,
+					  cnt - 1, sizeof(*psy->supplied_from),
 					  GFP_KERNEL);
 	if (!psy->supplied_from)
 		return -ENOMEM;
 
-	*psy->supplied_from = devm_kcalloc(&psy->dev,
-					   cnt - 1, sizeof(**psy->supplied_from),
-					   GFP_KERNEL);
-	if (!*psy->supplied_from)
-		return -ENOMEM;
-
 	return power_supply_populate_supplied_from(psy);
 }
 #else
-- 
2.43.0