| Message ID | 20221004171843.2737200-1-linux@roeck-us.net (mailing list archive) |
|---|---|
| State | Superseded, archived |
| Headers | show |
| Series | thermal/core: Fix parameter check when setting trip point temperatures | expand |
Hi Guenter, this has been already fixed and the PR has been sent to Rafael: https://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux.git/tag/?h=thermal-v6.1-rc1-2 Thanks for sending the fix anyway -- Daniel On 04/10/2022 19:18, Guenter Roeck wrote: > Commit 9326167058e8a ("thermal/core: Move set_trip_temp ops to the sysfs > code") changed the parameter check in trip_point_temp_store() from > > if (!tz->ops->set_trip_temp) > > to > if (!tz->ops->set_trip_temp && !tz->trips) > > That means the condition will pass if either tz->ops->set_trip_temp > or tz->trips is not NULL. Subsequently, access to tz->trips is > checked again, but tz->ops->set_trip_temp is called unconditionally. > This will result in a crash if the set_trip_temp callback is not set. > Add check if tz->ops->set_trip_temp is NULL before trying to call it. > > Fixes: 9326167058e8a ("thermal/core: Move set_trip_temp ops to the sysfs code") > Cc: Daniel Lezcano <daniel.lezcano@linaro.org> > Signed-off-by: Guenter Roeck <linux@roeck-us.net> > --- > drivers/thermal/thermal_sysfs.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c > index 78c5841bdfae..ec495c7dff03 100644 > --- a/drivers/thermal/thermal_sysfs.c > +++ b/drivers/thermal/thermal_sysfs.c > @@ -128,9 +128,11 @@ trip_point_temp_store(struct device *dev, struct device_attribute *attr, > if (kstrtoint(buf, 10, &temperature)) > return -EINVAL; > > - ret = tz->ops->set_trip_temp(tz, trip, temperature); > - if (ret) > - return ret; > + if (tz->ops->set_trip_temp) { > + ret = tz->ops->set_trip_temp(tz, trip, temperature); > + if (ret) > + return ret; > + } > > if (tz->trips) > tz->trips[trip].temperature = temperature;
diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c index 78c5841bdfae..ec495c7dff03 100644 --- a/drivers/thermal/thermal_sysfs.c +++ b/drivers/thermal/thermal_sysfs.c @@ -128,9 +128,11 @@ trip_point_temp_store(struct device *dev, struct device_attribute *attr, if (kstrtoint(buf, 10, &temperature)) return -EINVAL; - ret = tz->ops->set_trip_temp(tz, trip, temperature); - if (ret) - return ret; + if (tz->ops->set_trip_temp) { + ret = tz->ops->set_trip_temp(tz, trip, temperature); + if (ret) + return ret; + } if (tz->trips) tz->trips[trip].temperature = temperature;
Commit 9326167058e8a ("thermal/core: Move set_trip_temp ops to the sysfs code") changed the parameter check in trip_point_temp_store() from if (!tz->ops->set_trip_temp) to if (!tz->ops->set_trip_temp && !tz->trips) That means the condition will pass if either tz->ops->set_trip_temp or tz->trips is not NULL. Subsequently, access to tz->trips is checked again, but tz->ops->set_trip_temp is called unconditionally. This will result in a crash if the set_trip_temp callback is not set. Add check if tz->ops->set_trip_temp is NULL before trying to call it. Fixes: 9326167058e8a ("thermal/core: Move set_trip_temp ops to the sysfs code") Cc: Daniel Lezcano <daniel.lezcano@linaro.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net> --- drivers/thermal/thermal_sysfs.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)