* [PATCH -next] Fix null pointer dereference in thermal_release()
@ 2021-10-15 8:32 Yuanzheng Song
2021-10-15 11:59 ` Daniel Lezcano
2021-10-18 11:45 ` [thermal: thermal/next] thermal/core: " thermal-bot for Yuanzheng Song
0 siblings, 2 replies; 3+ messages in thread
From: Yuanzheng Song @ 2021-10-15 8:32 UTC (permalink / raw)
To: rafael, daniel.lezcano, amitk, rui.zhang, linux-pm, linux-kernel
If both dev_set_name() and device_register() failed, then
null pointer dereference occurs in thermal_release() which
will use strncmp() to compare the name.
So fix it by adding dev_set_name() return value check.
Signed-off-by: Yuanzheng Song <songyuanzheng@huawei.com>
---
drivers/thermal/thermal_core.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 9e243d9f929e..6904b97fd6ea 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -904,6 +904,10 @@ __thermal_cooling_device_register(struct device_node *np,
goto out_kfree_cdev;
cdev->id = ret;
+ ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
+ if (ret)
+ goto out_ida_remove;
+
cdev->type = kstrdup(type ? type : "", GFP_KERNEL);
if (!cdev->type) {
ret = -ENOMEM;
@@ -918,7 +922,6 @@ __thermal_cooling_device_register(struct device_node *np,
cdev->device.class = &thermal_class;
cdev->devdata = devdata;
thermal_cooling_device_setup_sysfs(cdev);
- dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
ret = device_register(&cdev->device);
if (ret)
goto out_kfree_type;
@@ -1229,6 +1232,10 @@ thermal_zone_device_register(const char *type, int trips, int mask,
tz->id = id;
strlcpy(tz->type, type, sizeof(tz->type));
+ result = dev_set_name(&tz->device, "thermal_zone%d", tz->id);
+ if (result)
+ goto remove_id;
+
if (!ops->critical)
ops->critical = thermal_zone_device_critical;
@@ -1250,7 +1257,6 @@ thermal_zone_device_register(const char *type, int trips, int mask,
/* A new thermal zone needs to be updated anyway. */
atomic_set(&tz->need_update, 1);
- dev_set_name(&tz->device, "thermal_zone%d", tz->id);
result = device_register(&tz->device);
if (result)
goto release_device;
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH -next] Fix null pointer dereference in thermal_release()
2021-10-15 8:32 [PATCH -next] Fix null pointer dereference in thermal_release() Yuanzheng Song
@ 2021-10-15 11:59 ` Daniel Lezcano
2021-10-18 11:45 ` [thermal: thermal/next] thermal/core: " thermal-bot for Yuanzheng Song
1 sibling, 0 replies; 3+ messages in thread
From: Daniel Lezcano @ 2021-10-15 11:59 UTC (permalink / raw)
To: Yuanzheng Song, rafael, amitk, rui.zhang, linux-pm, linux-kernel
On 15/10/2021 10:32, Yuanzheng Song wrote:
> If both dev_set_name() and device_register() failed, then
> null pointer dereference occurs in thermal_release() which
> will use strncmp() to compare the name.
>
> So fix it by adding dev_set_name() return value check.
>
> Signed-off-by: Yuanzheng Song <songyuanzheng@huawei.com>
Applied, thanks
> ---
> drivers/thermal/thermal_core.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
> index 9e243d9f929e..6904b97fd6ea 100644
> --- a/drivers/thermal/thermal_core.c
> +++ b/drivers/thermal/thermal_core.c
> @@ -904,6 +904,10 @@ __thermal_cooling_device_register(struct device_node *np,
> goto out_kfree_cdev;
> cdev->id = ret;
>
> + ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
> + if (ret)
> + goto out_ida_remove;
> +
> cdev->type = kstrdup(type ? type : "", GFP_KERNEL);
> if (!cdev->type) {
> ret = -ENOMEM;
> @@ -918,7 +922,6 @@ __thermal_cooling_device_register(struct device_node *np,
> cdev->device.class = &thermal_class;
> cdev->devdata = devdata;
> thermal_cooling_device_setup_sysfs(cdev);
> - dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
> ret = device_register(&cdev->device);
> if (ret)
> goto out_kfree_type;
> @@ -1229,6 +1232,10 @@ thermal_zone_device_register(const char *type, int trips, int mask,
> tz->id = id;
> strlcpy(tz->type, type, sizeof(tz->type));
>
> + result = dev_set_name(&tz->device, "thermal_zone%d", tz->id);
> + if (result)
> + goto remove_id;
> +
> if (!ops->critical)
> ops->critical = thermal_zone_device_critical;
>
> @@ -1250,7 +1257,6 @@ thermal_zone_device_register(const char *type, int trips, int mask,
> /* A new thermal zone needs to be updated anyway. */
> atomic_set(&tz->need_update, 1);
>
> - dev_set_name(&tz->device, "thermal_zone%d", tz->id);
> result = device_register(&tz->device);
> if (result)
> goto release_device;
>
--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs
Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog
^ permalink raw reply [flat|nested] 3+ messages in thread* [thermal: thermal/next] thermal/core: Fix null pointer dereference in thermal_release()
2021-10-15 8:32 [PATCH -next] Fix null pointer dereference in thermal_release() Yuanzheng Song
2021-10-15 11:59 ` Daniel Lezcano
@ 2021-10-18 11:45 ` thermal-bot for Yuanzheng Song
1 sibling, 0 replies; 3+ messages in thread
From: thermal-bot for Yuanzheng Song @ 2021-10-18 11:45 UTC (permalink / raw)
To: linux-pm; +Cc: Yuanzheng Song, Daniel Lezcano, rui.zhang, amitk
The following commit has been merged into the thermal/next branch of thermal:
Commit-ID: 1dd7128b839f631b31a9e9dce3aaf639bef74e9d
Gitweb: https://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux.git//1dd7128b839f631b31a9e9dce3aaf639bef74e9d
Author: Yuanzheng Song <songyuanzheng@huawei.com>
AuthorDate: Fri, 15 Oct 2021 08:32:30
Committer: Daniel Lezcano <daniel.lezcano@linaro.org>
CommitterDate: Fri, 15 Oct 2021 13:58:36 +02:00
thermal/core: Fix null pointer dereference in thermal_release()
If both dev_set_name() and device_register() failed, then null pointer
dereference occurs in thermal_release() which will use strncmp() to
compare the name.
So fix it by adding dev_set_name() return value check.
Signed-off-by: Yuanzheng Song <songyuanzheng@huawei.com>
Link: https://lore.kernel.org/r/20211015083230.67658-1-songyuanzheng@huawei.com
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
---
drivers/thermal/thermal_core.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 9e243d9..6904b97 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -904,6 +904,10 @@ __thermal_cooling_device_register(struct device_node *np,
goto out_kfree_cdev;
cdev->id = ret;
+ ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
+ if (ret)
+ goto out_ida_remove;
+
cdev->type = kstrdup(type ? type : "", GFP_KERNEL);
if (!cdev->type) {
ret = -ENOMEM;
@@ -918,7 +922,6 @@ __thermal_cooling_device_register(struct device_node *np,
cdev->device.class = &thermal_class;
cdev->devdata = devdata;
thermal_cooling_device_setup_sysfs(cdev);
- dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
ret = device_register(&cdev->device);
if (ret)
goto out_kfree_type;
@@ -1229,6 +1232,10 @@ thermal_zone_device_register(const char *type, int trips, int mask,
tz->id = id;
strlcpy(tz->type, type, sizeof(tz->type));
+ result = dev_set_name(&tz->device, "thermal_zone%d", tz->id);
+ if (result)
+ goto remove_id;
+
if (!ops->critical)
ops->critical = thermal_zone_device_critical;
@@ -1250,7 +1257,6 @@ thermal_zone_device_register(const char *type, int trips, int mask,
/* A new thermal zone needs to be updated anyway. */
atomic_set(&tz->need_update, 1);
- dev_set_name(&tz->device, "thermal_zone%d", tz->id);
result = device_register(&tz->device);
if (result)
goto release_device;
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-10-18 11:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-15 8:32 [PATCH -next] Fix null pointer dereference in thermal_release() Yuanzheng Song
2021-10-15 11:59 ` Daniel Lezcano
2021-10-18 11:45 ` [thermal: thermal/next] thermal/core: " thermal-bot for Yuanzheng Song
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.