| Message ID | 20200330140859.12535-1-tiwai@suse.de |
|---|---|
| State | New |
| Headers | show |
| Series | thermal: Add a sanity check for invalid state at stats update | expand |
diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c index aa99edb4dff7..a23c4e701d63 100644 --- a/drivers/thermal/thermal_sysfs.c +++ b/drivers/thermal/thermal_sysfs.c @@ -772,6 +772,11 @@ void thermal_cooling_device_stats_update(struct thermal_cooling_device *cdev, spin_lock(&stats->lock); + if (dev_WARN_ONCE(&cdev->device, new_state >= stats->max_states, + "new state %ld exceeds max_state %ld", + new_state, stats->max_states)) + goto unlock; + if (stats->state == new_state) goto unlock;
The thermal sysfs handler keeps the statistics table with the fixed size that was determined from the initial max_states() call, and the table entry is updated at each sysfs cur_state write call. And, when the driver's set_cur_state() ops accepts the value given from user-space, the thermal sysfs core blindly applies it to the statistics table entry, which may overflow and cause an Oops. Although it's rather a bug in the driver's ops implementations, we shouldn't crash but rather give a proper warning instead. This patch adds a sanity check for avoiding such an OOB access and warns with a stack trace to show the suspicious device in question. Signed-off-by: Takashi Iwai <tiwai@suse.de> --- We've hit some crash by stress tests, and this patch at least works around the crash itself. While the actual bug fix of the buggy driver is still being investigated, I submit the hardening in the core side at first. drivers/thermal/thermal_sysfs.c | 5 +++++ 1 file changed, 5 insertions(+)