From patchwork Tue Nov 3 22:14:34 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 7547341 X-Patchwork-Delegate: eduardo.valentin@ti.com Return-Path: X-Original-To: patchwork-linux-pm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id AB1C4BEEA4 for ; Tue, 3 Nov 2015 22:14:52 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id CC1DE20794 for ; Tue, 3 Nov 2015 22:14:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id BF79A2078F for ; Tue, 3 Nov 2015 22:14:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932711AbbKCWOt (ORCPT ); Tue, 3 Nov 2015 17:14:49 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:42311 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932647AbbKCWOt (ORCPT ); Tue, 3 Nov 2015 17:14:49 -0500 Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id tA3MEl8f019961 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 3 Nov 2015 22:14:47 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.13.8/8.13.8) with ESMTP id tA3MEkvD021367 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 3 Nov 2015 22:14:47 GMT Received: from abhmp0018.oracle.com (abhmp0018.oracle.com [141.146.116.24]) by aserv0122.oracle.com (8.13.8/8.13.8) with ESMTP id tA3MEkl5013036; Tue, 3 Nov 2015 22:14:46 GMT Received: from mwanda (/154.0.139.178) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 03 Nov 2015 14:14:46 -0800 Date: Wed, 4 Nov 2015 01:14:34 +0300 From: Dan Carpenter To: Zhang Rui Cc: Eduardo Valentin , linux-pm@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] thermal: underflow in trip_point_temp_store() Message-ID: <20151103221434.GB19280@mwanda> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) X-Source-IP: aserv0021.oracle.com [141.146.126.233] Sender: linux-pm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pm@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This is to address a static checker warning about an underflow in imx_set_trip_temp(). The checker is complaining that we have a user supplied value for "temp" from kstrtoul() where we treat it as signed, we cap the upper but we accept negative values. This looks unintentional since the caller is using unsigned longs to represent the temperature. Let's change it to int and reject negatives in the caller. Also I changed it to reject negative "trip" values as well. Signed-off-by: Dan Carpenter --- Someday we will use super cooled CPUs and we will need to rethink this code. :) -- To unsubscribe from this list: send the line "unsubscribe linux-pm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index d9e525c..151a630 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -664,7 +664,7 @@ trip_point_temp_store(struct device *dev, struct device_attribute *attr, { struct thermal_zone_device *tz = to_thermal_zone(dev); int trip, ret; - unsigned long temperature; + int temperature; if (!tz->ops->set_trip_temp) return -EPERM; @@ -672,7 +672,9 @@ trip_point_temp_store(struct device *dev, struct device_attribute *attr, if (!sscanf(attr->attr.name, "trip_point_%d_temp", &trip)) return -EINVAL; - if (kstrtoul(buf, 10, &temperature)) + if (kstrtoint(buf, 10, &temperature)) + return -EINVAL; + if (trip < 0 || temperature < 0) return -EINVAL; ret = tz->ops->set_trip_temp(tz, trip, temperature);