* [PATCH 5.4] thermal: Fix NULL pointer dereferences in of_thermal_ functions
@ 2022-08-02 3:42 Mark-PK Tsai
2022-08-03 11:46 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Mark-PK Tsai @ 2022-08-02 3:42 UTC (permalink / raw)
To: Rafael J. Wysocki, Daniel Lezcano, Amit Kucheria, Zhang Rui,
Matthias Brugger, Nathan Chancellor, Nick Desaulniers, Tom Rix
Cc: yj.chiang, Subbaraman Narayanamurthy, Rafael J . Wysocki, stable,
Mark-PK Tsai, linux-pm, linux-kernel, linux-arm-kernel,
linux-mediatek, llvm
From: Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>
commit 96cfe05051fd8543cdedd6807ec59a0e6c409195 upstream.
of_parse_thermal_zones() parses the thermal-zones node and registers a
thermal_zone device for each subnode. However, if a thermal zone is
consuming a thermal sensor and that thermal sensor device hasn't probed
yet, an attempt to set trip_point_*_temp for that thermal zone device
can cause a NULL pointer dereference. Fix it.
console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp
...
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
...
Call trace:
of_thermal_set_trip_temp+0x40/0xc4
trip_point_temp_store+0xc0/0x1dc
dev_attr_store+0x38/0x88
sysfs_kf_write+0x64/0xc0
kernfs_fop_write_iter+0x108/0x1d0
vfs_write+0x2f4/0x368
ksys_write+0x7c/0xec
__arm64_sys_write+0x20/0x30
el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc
do_el0_svc+0x28/0xa0
el0_svc+0x14/0x24
el0_sync_handler+0x88/0xec
el0_sync+0x1c0/0x200
While at it, fix the possible NULL pointer dereference in other
functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(),
of_thermal_get_trend().
Suggested-by: David Collins <quic_collinsd@quicinc.com>
Signed-off-by: Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
---
drivers/thermal/of-thermal.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index 68d0c181ec7b..1f38da5da6e4 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -91,7 +91,7 @@ static int of_thermal_get_temp(struct thermal_zone_device *tz,
{
struct __thermal_zone *data = tz->devdata;
- if (!data->ops->get_temp)
+ if (!data->ops || !data->ops->get_temp)
return -EINVAL;
return data->ops->get_temp(data->sensor_data, temp);
@@ -188,6 +188,9 @@ static int of_thermal_set_emul_temp(struct thermal_zone_device *tz,
{
struct __thermal_zone *data = tz->devdata;
+ if (!data->ops || !data->ops->set_emul_temp)
+ return -EINVAL;
+
return data->ops->set_emul_temp(data->sensor_data, temp);
}
@@ -196,7 +199,7 @@ static int of_thermal_get_trend(struct thermal_zone_device *tz, int trip,
{
struct __thermal_zone *data = tz->devdata;
- if (!data->ops->get_trend)
+ if (!data->ops || !data->ops->get_trend)
return -EINVAL;
return data->ops->get_trend(data->sensor_data, trip, trend);
@@ -336,7 +339,7 @@ static int of_thermal_set_trip_temp(struct thermal_zone_device *tz, int trip,
if (trip >= data->ntrips || trip < 0)
return -EDOM;
- if (data->ops->set_trip_temp) {
+ if (data->ops && data->ops->set_trip_temp) {
int ret;
ret = data->ops->set_trip_temp(data->sensor_data, trip, temp);
--
2.18.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 5.4] thermal: Fix NULL pointer dereferences in of_thermal_ functions
2022-08-02 3:42 [PATCH 5.4] thermal: Fix NULL pointer dereferences in of_thermal_ functions Mark-PK Tsai
@ 2022-08-03 11:46 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2022-08-03 11:46 UTC (permalink / raw)
To: Mark-PK Tsai
Cc: Rafael J. Wysocki, Daniel Lezcano, Amit Kucheria, Zhang Rui,
Matthias Brugger, Nathan Chancellor, Nick Desaulniers, Tom Rix,
yj.chiang, Subbaraman Narayanamurthy, Rafael J . Wysocki, stable,
linux-pm, linux-kernel, linux-arm-kernel, linux-mediatek, llvm
On Tue, Aug 02, 2022 at 11:42:16AM +0800, Mark-PK Tsai wrote:
> From: Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>
>
> commit 96cfe05051fd8543cdedd6807ec59a0e6c409195 upstream.
>
> of_parse_thermal_zones() parses the thermal-zones node and registers a
> thermal_zone device for each subnode. However, if a thermal zone is
> consuming a thermal sensor and that thermal sensor device hasn't probed
> yet, an attempt to set trip_point_*_temp for that thermal zone device
> can cause a NULL pointer dereference. Fix it.
>
> console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp
> ...
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
> ...
> Call trace:
> of_thermal_set_trip_temp+0x40/0xc4
> trip_point_temp_store+0xc0/0x1dc
> dev_attr_store+0x38/0x88
> sysfs_kf_write+0x64/0xc0
> kernfs_fop_write_iter+0x108/0x1d0
> vfs_write+0x2f4/0x368
> ksys_write+0x7c/0xec
> __arm64_sys_write+0x20/0x30
> el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc
> do_el0_svc+0x28/0xa0
> el0_svc+0x14/0x24
> el0_sync_handler+0x88/0xec
> el0_sync+0x1c0/0x200
>
> While at it, fix the possible NULL pointer dereference in other
> functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(),
> of_thermal_get_trend().
>
> Suggested-by: David Collins <quic_collinsd@quicinc.com>
> Signed-off-by: Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>
> Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
> ---
> drivers/thermal/of-thermal.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-08-03 11:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-08-02 3:42 [PATCH 5.4] thermal: Fix NULL pointer dereferences in of_thermal_ functions Mark-PK Tsai
2022-08-03 11:46 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).