| Message ID | 20240405090720.16419-1-amishin@t-argos.ru (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Daniel Lezcano |
| Headers | show |
| Series | drivers: thermal: tsens: Fix null pointer dereference | expand |
On 4/5/24 11:07, Aleksandr Mishin wrote: > compute_intercept_slope() is called from calibrate_8960() (in tsens-8960.c) > as compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to null > pointer dereference (if DEBUG or DYNAMIC_DEBUG set). > Fix this bug by adding null pointer check. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: dfc1193d4dbd ("thermal/drivers/tsens: Replace custom 8960 apis with generic apis") > Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> > --- Maybe we can replace p2[i] with p2 ? p2[i] : 0 Konrad
On 09.04.2024 12:52, Konrad Dybcio wrote: > > > On 4/5/24 11:07, Aleksandr Mishin wrote: >> compute_intercept_slope() is called from calibrate_8960() (in >> tsens-8960.c) >> as compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to >> null >> pointer dereference (if DEBUG or DYNAMIC_DEBUG set). >> Fix this bug by adding null pointer check. >> >> Found by Linux Verification Center (linuxtesting.org) with SVACE. >> >> Fixes: dfc1193d4dbd ("thermal/drivers/tsens: Replace custom 8960 apis >> with generic apis") >> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> >> --- > > Maybe we can replace p2[i] with p2 ? p2[i] : 0 Your solution look better for me. Thanks. I'll offer v2 patch > > Konrad
diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c index 6d7c16ccb44d..f7dd70e8d158 100644 --- a/drivers/thermal/qcom/tsens.c +++ b/drivers/thermal/qcom/tsens.c @@ -262,9 +262,10 @@ void compute_intercept_slope(struct tsens_priv *priv, u32 *p1, int num, den; for (i = 0; i < priv->num_sensors; i++) { - dev_dbg(priv->dev, - "%s: sensor%d - data_point1:%#x data_point2:%#x\n", - __func__, i, p1[i], p2[i]); + if (p1 && p2) + dev_dbg(priv->dev, + "%s: sensor%d - data_point1:%#x data_point2:%#x\n", + __func__, i, p1[i], p2[i]); if (!priv->sensor[i].slope) priv->sensor[i].slope = SLOPE_DEFAULT;
compute_intercept_slope() is called from calibrate_8960() (in tsens-8960.c) as compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to null pointer dereference (if DEBUG or DYNAMIC_DEBUG set). Fix this bug by adding null pointer check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfc1193d4dbd ("thermal/drivers/tsens: Replace custom 8960 apis with generic apis") Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> --- drivers/thermal/qcom/tsens.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)