RE: [ASAP] thermal_sys.c NULL ptr deref patch likely incomplete

["Zhang, Rui" <rui.zhang@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 1452 bytes --]



> -----Original Message-----
> From: Andreas Mohr [mailto:andi@lisas.de]
> Sent: Thursday, February 14, 2013 10:44 PM
> To: Zhang, Rui
> Cc: linux-kernel@vger.kernel.org
> Subject: [ASAP] thermal_sys.c NULL ptr deref patch likely incomplete
> Importance: High
> 
> Hi,
> 
> I just had a
> 
> # cat /sys/class/thermal/thermal_zone0/policy
> (null)
> 
> 
> When looking at the code (on my -rc7), I saw:
> 
> drivers/thermal/thermal_sys.c
> 
> static ssize_t
> policy_show(struct device *dev, struct device_attribute *devattr, char
> *buf)
> {
>         struct thermal_zone_device *tz = to_thermal_zone(dev);
> 
>         return sprintf(buf, "%s\n", tz->governor->name);
> }
> 
> 
> (not sure though why I manage to get a "(null)" rather than a crash
> due to the dereferencing prior to output - possibly since I do have a
> valid governor allocated yet then only its name field is null?)
> 
Hmm,

Please apply the debug patch and see what you can get here.

Thanks,
rui
> 
> Seems we are missing a critical (and -rc-relevant) patch here
> (and perhaps at other locations in this file, too, given that
> this one was missed last time?).
> 
> Currently trying to get acerhdf operation into a working state
> (and having some trouble with it - didn't know that I probably need
> some
> governor setup which seems to have just been available on my last setup,
> or so)
> 
> Thanks,
> 
> Andreas Mohr

[-- Attachment #2: acerhdf-debug-2.patch --]
[-- Type: application/octet-stream, Size: 618 bytes --]

diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index 8c8ce80..57c83aa 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -697,7 +697,9 @@ policy_show(struct device *dev, struct device_attribute *devattr, char *buf)
 {
 	struct thermal_zone_device *tz = to_thermal_zone(dev);
 
-	return sprintf(buf, "%s\n", tz->governor->name);
+	return sprintf(buf, "%s\n", tz->governor ? (tz->governor->name ? tz->governor->name : "NULL name") : "NULL governor");
+
+//	return sprintf(buf, "%s\n", tz->governor->name);
 }
 
 static DEVICE_ATTR(type, 0444, type_show, NULL);