CVE-2023-53166

In the Linux kernel, the following vulnerability has been resolved:

power: supply: bq25890: Fix externalpowerchanged race

bq25890chargerexternalpowerchanged() dereferences bq->charger, which gets sets in bq25890powersupply_init() like this:

bq->charger = devmpowersupplyregister(bq->dev, &bq->desc, &psycfg);

As soon as devmpowersupplyregister() has called deviceadd() the externalpowerchanged callback can get called. So there is a window where bq25890chargerexternalpowerchanged() may get called while bq->charger has not been set yet leading to a NULL pointer dereference.

This race hits during boot sometimes on a Lenovo Yoga Book 1 yb1-x90f when the chtwcovepwrsrc (extcon) power_supply is done with detecting the connected charger-type which happens to exactly hit the small window:

BUG: kernel NULL pointer dereference, address: 0000000000000018 <snip> RIP: 0010:__powersupplyissuppliedby+0xb/0xb0 <snip> Call Trace: <TASK> __powersupplygetsupplierproperty+0x19/0x50 classforeachdevice+0xb1/0xe0 powersupplygetpropertyfromsupplier+0x2e/0x50 bq25890chargerexternalpowerchanged+0x38/0x1b0 [bq25890_charger] _powersupplychangedwork+0x30/0x40 classforeachdevice+0xb1/0xe0 powersupplychangedwork+0x5f/0xe0 <snip>

Fixing this is easy. The externalpowerchanged callback gets passed the powersupply which will eventually get stored in bq->charger, so bq25890chargerexternalpower_changed() can simply directly use the passed in psy argument which is always valid.