Linux-PM Archive on lore.kernel.org
 help / color / Atom feed
From: "thermal-bot for Manaf Meethalavalappu Pallikunhi"  <tip-bot2@linutronix.de>
To: linux-pm@vger.kernel.org
Cc: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>,
	Daniel Lezcano <daniel.lezcano@linaro.org>,
	rui.zhang@intel.com, amitk@kernel.org
Subject: [thermal: thermal/fixes] drivers: thermal: Add NULL pointer check before using cooling device stats
Date: Wed, 17 Mar 2021 12:39:14 -0000
Message-ID: <161598475463.398.3494185643778469173.tip-bot2@tip-bot2> (raw)
In-Reply-To: <1607367181-24589-1-git-send-email-manafm@codeaurora.org>

The following commit has been merged into the thermal/fixes branch of thermal:

Commit-ID:     35c31b81f19728220652d588ed464d75d1a8f05f
Gitweb:        https://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux.git//35c31b81f19728220652d588ed464d75d1a8f05f
Author:        Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>
AuthorDate:    Tue, 08 Dec 2020 00:23:01 +05:30
Committer:     Daniel Lezcano <daniel.lezcano@linaro.org>
CommitterDate: Wed, 10 Mar 2021 12:53:23 +01:00

drivers: thermal: Add NULL pointer check before using cooling device stats

There is a possible chance that some cooling device stats buffer
allocation fails due to very high cooling device max state value.
Later cooling device update sysfs can try to access stats data
for the same cooling device. It will lead to NULL pointer
dereference issue.

Add a NULL pointer check before accessing thermal cooling device
stats data. It fixes the following bug

[ 26.812833] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
[ 27.122960] Call trace:
[ 27.122963] do_raw_spin_lock+0x18/0xe8
[ 27.122966] _raw_spin_lock+0x24/0x30
[ 27.128157] thermal_cooling_device_stats_update+0x24/0x98
[ 27.128162] cur_state_store+0x88/0xb8
[ 27.128166] dev_attr_store+0x40/0x58
[ 27.128169] sysfs_kf_write+0x50/0x68
[ 27.133358] kernfs_fop_write+0x12c/0x1c8
[ 27.133362] __vfs_write+0x54/0x160
[ 27.152297] vfs_write+0xcc/0x188
[ 27.157132] ksys_write+0x78/0x108
[ 27.162050] ksys_write+0xf8/0x108
[ 27.166968] __arm_smccc_hvc+0x158/0x4b0
[ 27.166973] __arm_smccc_hvc+0x9c/0x4b0
[ 27.186005] el0_svc+0x8/0xc

Signed-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/1607367181-24589-1-git-send-email-manafm@codeaurora.org
---
 drivers/thermal/thermal_sysfs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
index 345917a..1c4aac8 100644
--- a/drivers/thermal/thermal_sysfs.c
+++ b/drivers/thermal/thermal_sysfs.c
@@ -674,6 +674,9 @@ void thermal_cooling_device_stats_update(struct thermal_cooling_device *cdev,
 {
 	struct cooling_dev_stats *stats = cdev->stats;
 
+	if (!stats)
+		return;
+
 	spin_lock(&stats->lock);
 
 	if (stats->state == new_state)

      parent reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-07 18:53 [PATCH v2] " Manaf Meethalavalappu Pallikunhi
2021-03-05 17:24 ` manafm
2021-03-05 17:51   ` Daniel Lezcano
2021-03-17 12:39 ` thermal-bot for Manaf Meethalavalappu Pallikunhi [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=161598475463.398.3494185643778469173.tip-bot2@tip-bot2 \
    --to=tip-bot2@linutronix.de \
    --cc=amitk@kernel.org \
    --cc=daniel.lezcano@linaro.org \
    --cc=linux-pm@vger.kernel.org \
    --cc=manafm@codeaurora.org \
    --cc=rui.zhang@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-PM Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-pm/0 linux-pm/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-pm linux-pm/ https://lore.kernel.org/linux-pm \
		linux-pm@vger.kernel.org
	public-inbox-index linux-pm

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-pm


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git