Re: [PATCH] power: supply: bq256xx: fix uninitialized battery info pointer in bq256xx_hw_init

[Sebastian Reichel <sebastian.reichel@collabora.com>]

[-- Attachment #1: Type: text/plain, Size: 2925 bytes --]

Hi,

On Tue, Aug 25, 2026 at 05:06:26PM +0800, Yang Zi wrote:
> In bq256xx_hw_init(), the local pointer `bat_info` is passed to
> power_supply_get_battery_info() without being initialized. When that
> function fails with an error other than -ENOMEM it does not set the
> output pointer, yet the code went on to dereference it while applying
> "default" values, leading to a general protection fault (NULL
> dereference).
> 
> Initialize the pointer to NULL and return the error immediately instead
> of dereferencing an uninitialized pointer. The battery information is
> only used on the success path, where it is guaranteed to be valid.
> 
> Signed-off-by: Yang Zi <2959243019@qq.com>
> ---

This does not apply:

Patch failed at 0001 power: supply: bq256xx: fix uninitialized battery info pointer in bq256xx_hw_init
error: corrupt patch at line 6

Greetings,

-- Sebastian

> diff --git a/drivers/power/supply/bq256xx_charger.c b/drivers/power/supply/bq256xx_charger.c
> index 4b1f81b1ed86..6a5f73bcb928 100644
> --- a/drivers/power/supply/bq256xx_charger.c
> +++ b/drivers/power/supply/bq256xx_charger.c
> @@ -1556,7 +1556,7 @@ static int bq256xx_power_supply_init(struct bq256xx_device *bq,
>  
>  static int bq256xx_hw_init(struct bq256xx_device *bq)
>  {
> -    struct power_supply_battery_info *bat_info;
> +    struct power_supply_battery_info *bat_info = NULL;
>      int wd_reg_val = BQ256XX_WATCHDOG_DIS;
>      int ret = 0;
>      int i;
> @@ -1581,33 +1581,14 @@ static int bq256xx_hw_init(struct bq256xx_device *bq)
>      if (ret == -ENOMEM)
>          return ret;
>  
> -    if (ret) {
> -        dev_warn(bq->dev, "battery info missing, default values will be applied\n");
> -
> -        bat_info->constant_charge_current_max_ua =
> -                bq->chip_info->bq256xx_def_ichg;
> -
> -        bat_info->constant_charge_voltage_max_uv =
> -                bq->chip_info->bq256xx_def_vbatreg;
> -
> -        bat_info->precharge_current_ua =
> -                bq->chip_info->bq256xx_def_iprechg;
> -
> -        bat_info->charge_term_current_ua =
> -                bq->chip_info->bq256xx_def_iterm;
> +    if (ret)
> +        return ret;
>  
> -        bq->init_data.ichg_max =
> -                bq->chip_info->bq256xx_max_ichg;
> +    bq->init_data.ichg_max =
> +        bat_info->constant_charge_current_max_ua;
>  
> -        bq->init_data.vbatreg_max =
> -                bq->chip_info->bq256xx_max_vbatreg;
> -    } else {
> -        bq->init_data.ichg_max =
> -            bat_info->constant_charge_current_max_ua;
> -
> -        bq->init_data.vbatreg_max =
> -            bat_info->constant_charge_voltage_max_uv;
> -    }
> +    bq->init_data.vbatreg_max =
> +        bat_info->constant_charge_voltage_max_uv;
>  
>      ret = bq->chip_info->bq256xx_set_vindpm(bq, bq->init_data.vindpm);
>      if (ret)
> 
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]