[PATCH] power: supply: bq256xx: fix uninitialized battery info pointer in bq256xx_hw_init

[PATCH] power: supply: bq256xx: fix uninitialized battery info pointer in bq256xx_hw_init

[Yang Zi]

In bq256xx_hw_init(), the local pointer `bat_info` is passed to
power_supply_get_battery_info() without being initialized. When that
function fails with an error other than -ENOMEM it does not set the
output pointer, yet the code went on to dereference it while applying
"default" values, leading to a general protection fault (NULL
dereference).

Initialize the pointer to NULL and return the error immediately instead
of dereferencing an uninitialized pointer. The battery information is
only used on the success path, where it is guaranteed to be valid.

Signed-off-by: Yang Zi <2959243019@qq.com>
---
diff --git a/drivers/power/supply/bq256xx_charger.c b/drivers/power/supply/bq256xx_charger.c
index 4b1f81b1ed86..6a5f73bcb928 100644
--- a/drivers/power/supply/bq256xx_charger.c
+++ b/drivers/power/supply/bq256xx_charger.c
@@ -1556,7 +1556,7 @@ static int bq256xx_power_supply_init(struct bq256xx_device *bq,
 
 static int bq256xx_hw_init(struct bq256xx_device *bq)
 {
-    struct power_supply_battery_info *bat_info;
+    struct power_supply_battery_info *bat_info = NULL;
     int wd_reg_val = BQ256XX_WATCHDOG_DIS;
     int ret = 0;
     int i;
@@ -1581,33 +1581,14 @@ static int bq256xx_hw_init(struct bq256xx_device *bq)
     if (ret == -ENOMEM)
         return ret;
 
-    if (ret) {
-        dev_warn(bq->dev, "battery info missing, default values will be applied\n");
-
-        bat_info->constant_charge_current_max_ua =
-                bq->chip_info->bq256xx_def_ichg;
-
-        bat_info->constant_charge_voltage_max_uv =
-                bq->chip_info->bq256xx_def_vbatreg;
-
-        bat_info->precharge_current_ua =
-                bq->chip_info->bq256xx_def_iprechg;
-
-        bat_info->charge_term_current_ua =
-                bq->chip_info->bq256xx_def_iterm;
+    if (ret)
+        return ret;
 
-        bq->init_data.ichg_max =
-                bq->chip_info->bq256xx_max_ichg;
+    bq->init_data.ichg_max =
+        bat_info->constant_charge_current_max_ua;
 
-        bq->init_data.vbatreg_max =
-                bq->chip_info->bq256xx_max_vbatreg;
-    } else {
-        bq->init_data.ichg_max =
-            bat_info->constant_charge_current_max_ua;
-
-        bq->init_data.vbatreg_max =
-            bat_info->constant_charge_voltage_max_uv;
-    }
+    bq->init_data.vbatreg_max =
+        bat_info->constant_charge_voltage_max_uv;
 
     ret = bq->chip_info->bq256xx_set_vindpm(bq, bq->init_data.vindpm);
     if (ret)

Re: [PATCH] power: supply: bq256xx: fix uninitialized battery info pointer in bq256xx_hw_init

[Sebastian Reichel]

[-- Attachment #1: Type: text/plain, Size: 2925 bytes --]

Hi,

On Tue, Aug 25, 2026 at 05:06:26PM +0800, Yang Zi wrote:
> In bq256xx_hw_init(), the local pointer `bat_info` is passed to
> power_supply_get_battery_info() without being initialized. When that
> function fails with an error other than -ENOMEM it does not set the
> output pointer, yet the code went on to dereference it while applying
> "default" values, leading to a general protection fault (NULL
> dereference).
> 
> Initialize the pointer to NULL and return the error immediately instead
> of dereferencing an uninitialized pointer. The battery information is
> only used on the success path, where it is guaranteed to be valid.
> 
> Signed-off-by: Yang Zi <2959243019@qq.com>
> ---

This does not apply:

Patch failed at 0001 power: supply: bq256xx: fix uninitialized battery info pointer in bq256xx_hw_init
error: corrupt patch at line 6

Greetings,

-- Sebastian

> diff --git a/drivers/power/supply/bq256xx_charger.c b/drivers/power/supply/bq256xx_charger.c
> index 4b1f81b1ed86..6a5f73bcb928 100644
> --- a/drivers/power/supply/bq256xx_charger.c
> +++ b/drivers/power/supply/bq256xx_charger.c
> @@ -1556,7 +1556,7 @@ static int bq256xx_power_supply_init(struct bq256xx_device *bq,
>  
>  static int bq256xx_hw_init(struct bq256xx_device *bq)
>  {
> -    struct power_supply_battery_info *bat_info;
> +    struct power_supply_battery_info *bat_info = NULL;
>      int wd_reg_val = BQ256XX_WATCHDOG_DIS;
>      int ret = 0;
>      int i;
> @@ -1581,33 +1581,14 @@ static int bq256xx_hw_init(struct bq256xx_device *bq)
>      if (ret == -ENOMEM)
>          return ret;
>  
> -    if (ret) {
> -        dev_warn(bq->dev, "battery info missing, default values will be applied\n");
> -
> -        bat_info->constant_charge_current_max_ua =
> -                bq->chip_info->bq256xx_def_ichg;
> -
> -        bat_info->constant_charge_voltage_max_uv =
> -                bq->chip_info->bq256xx_def_vbatreg;
> -
> -        bat_info->precharge_current_ua =
> -                bq->chip_info->bq256xx_def_iprechg;
> -
> -        bat_info->charge_term_current_ua =
> -                bq->chip_info->bq256xx_def_iterm;
> +    if (ret)
> +        return ret;
>  
> -        bq->init_data.ichg_max =
> -                bq->chip_info->bq256xx_max_ichg;
> +    bq->init_data.ichg_max =
> +        bat_info->constant_charge_current_max_ua;
>  
> -        bq->init_data.vbatreg_max =
> -                bq->chip_info->bq256xx_max_vbatreg;
> -    } else {
> -        bq->init_data.ichg_max =
> -            bat_info->constant_charge_current_max_ua;
> -
> -        bq->init_data.vbatreg_max =
> -            bat_info->constant_charge_voltage_max_uv;
> -    }
> +    bq->init_data.vbatreg_max =
> +        bat_info->constant_charge_voltage_max_uv;
>  
>      ret = bq->chip_info->bq256xx_set_vindpm(bq, bq->init_data.vindpm);
>      if (ret)
> 
> 
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]