drivers: thermal: Add NULL pointer check before using cooling device stats
PATCH v2 1/1 drivers: thermal: Add NULL pointer check before using cooling device stats
There is a possible chance that some cooling device stats buffer allocation fails due to very high cooling device max state value. Later cooling device update sysfs can try to access stats data for the same cooling device. It will lead to NULL pointer dereference issue.
Add a NULL pointer check before accessing thermal cooling device stats data. It fixes the following bug
[ 26.812833] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 27.122960] Call trace: [ 27.122963] do_raw_spin_lock+0x18/0xe8 [ 27.122966] _raw_spin_lock+0x24/0x30 [ 27.128157] thermal_cooling_device_stats_update+0x24/0x98 [ 27.128162] cur_state_store+0x88/0xb8 [ 27.128166] dev_attr_store+0x40/0x58 [ 27.128169] sysfs_kf_write+0x50/0x68 [ 27.133358] kernfs_fop_write+0x12c/0x1c8 [ 27.133362] __vfs_write+0x54/0x160 [ 27.152297] vfs_write+0xcc/0x188 [ 27.157132] ksys_write+0x78/0x108 [ 27.162050] ksys_write+0xf8/0x108 [ 27.166968] __arm_smccc_hvc+0x158/0x4b0 [ 27.166973] __arm_smccc_hvc+0x9c/0x4b0 [ 27.186005] el0_svc+0x8/0xc
--- drivers/thermal/thermal_sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/thermal_sysfs.c +3 -0
@@ -827,6 +827,9 @@ void thermal_cooling_device_stats_update(struct thermal_cooling_device *cdev, {struct cooling_dev_stats *stats = cdev->stats; +if (!stats) +return ; +spin_lock (&stats->lock);if (stats->state == new_state)
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
On 2020-12-08 00:23, Manaf Meethalavalappu Pallikunhi wrote:
Gentle reminder..
Quoted 47 lines
There is a possible chance that some cooling device stats buffer allocation fails due to very high cooling device max state value. Later cooling device update sysfs can try to access stats data for the same cooling device. It will lead to NULL pointer dereference issue.
Add a NULL pointer check before accessing thermal cooling device stats data. It fixes the following bug
[ 26.812833] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 27.122960] Call trace: [ 27.122963] do_raw_spin_lock+0x18/0xe8 [ 27.122966] _raw_spin_lock+0x24/0x30 [ 27.128157] thermal_cooling_device_stats_update+0x24/0x98 [ 27.128162] cur_state_store+0x88/0xb8 [ 27.128166] dev_attr_store+0x40/0x58 [ 27.128169] sysfs_kf_write+0x50/0x68 [ 27.133358] kernfs_fop_write+0x12c/0x1c8 [ 27.133362] __vfs_write+0x54/0x160 [ 27.152297] vfs_write+0xcc/0x188 [ 27.157132] ksys_write+0x78/0x108 [ 27.162050] ksys_write+0xf8/0x108 [ 27.166968] __arm_smccc_hvc+0x158/0x4b0 [ 27.166973] __arm_smccc_hvc+0x9c/0x4b0 [ 27.186005] el0_svc+0x8/0xcSigned-off-by Manaf Meethalavalappu Pallikunhi <[email protected]>--- drivers/thermal/thermal_sysfs.c | 3 +++ 1 file changed, 3 insertions(+)drivers/thermal/thermal_sysfs.c +3
-0@@ -827,6 +827,9 @@ void thermal_cooling_device_stats_update(struct thermal_cooling_device *cdev, {struct cooling_dev_stats *stats = cdev->stats; +if (!stats) +return ; +spin_lock (&stats->lock);if (
stats->state==new_state)
Quoted 3 lines · On 05/03/2021 18:24, [email protected] wrote:
On 2020-12-08 00:23, Manaf Meethalavalappu Pallikunhi wrote:
Gentle reminder..
Thanks for the reminder, I'll pick it for the next -rc
-- Daniel
Signature · 5 lines
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook | <http://twitter.com/#!/linaroorg> Twitter | <http://www.linaro.org/linaro-blog/> Blog
The following commit has been merged into the thermal/fixes branch of thermal:
The following commit has been merged into the thermal/fixes branch of thermal:
Commit-ID: 35c31b81f19728220652d588ed464d75d1a8f05f Gitweb: https://git.kernel.org/pub/scm/linux/kernel/git/thermal/linux.git//35c31b81f19728220652d588ed464d75d1a8f05f Author: Manaf Meethalavalappu Pallikunhi <[email protected]> AuthorDate: Tue, 08 Dec 2020 00:23:01 +05:30 Committer: Daniel Lezcano <[email protected]> CommitterDate: Wed, 10 Mar 2021 12:53:23 +01:00
drivers: thermal: Add NULL pointer check before using cooling device stats
There is a possible chance that some cooling device stats buffer allocation fails due to very high cooling device max state value. Later cooling device update sysfs can try to access stats data for the same cooling device. It will lead to NULL pointer dereference issue.
Add a NULL pointer check before accessing thermal cooling device stats data. It fixes the following bug
[ 26.812833] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 27.122960] Call trace: [ 27.122963] do_raw_spin_lock+0x18/0xe8 [ 27.122966] _raw_spin_lock+0x24/0x30 [ 27.128157] thermal_cooling_device_stats_update+0x24/0x98 [ 27.128162] cur_state_store+0x88/0xb8 [ 27.128166] dev_attr_store+0x40/0x58 [ 27.128169] sysfs_kf_write+0x50/0x68 [ 27.133358] kernfs_fop_write+0x12c/0x1c8 [ 27.133362] __vfs_write+0x54/0x160 [ 27.152297] vfs_write+0xcc/0x188 [ 27.157132] ksys_write+0x78/0x108 [ 27.162050] ksys_write+0xf8/0x108 [ 27.166968] __arm_smccc_hvc+0x158/0x4b0 [ 27.166973] __arm_smccc_hvc+0x9c/0x4b0 [ 27.186005] el0_svc+0x8/0xc
--- drivers/thermal/thermal_sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/thermal_sysfs.c +3 -0
@@ -674,6 +674,9 @@ void thermal_cooling_device_stats_update(struct thermal_cooling_device *cdev, {struct cooling_dev_stats *stats = cdev->stats; +if (!stats) +return ; +spin_lock (&stats->lock);if (stats->state == new_state)