2023-03-29 09:03:03

by Zhang, Rui

[permalink] [raw]
Subject: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

When the hwmon device node of a thermal zone device is not found,
using hwmon->device causes a kernel NULL pointer dereference.

Reported-by: Preble Adam C <[email protected]>
Signed-off-by: Zhang Rui <[email protected]>
---
Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
I'm not sure if the Fix tag applies to such commit or not.
---
drivers/thermal/thermal_hwmon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index c59db17dddd6..261743f461be 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
hwmon = thermal_hwmon_lookup_by_type(tz);
if (unlikely(!hwmon)) {
/* Should never happen... */
- dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
+ dev_dbg(&tz->device, "hwmon device lookup failed!\n");
return;
}

--
2.25.1


2023-03-29 10:06:55

by Daniel Lezcano

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On 29/03/2023 11:00, Zhang Rui wrote:
> When the hwmon device node of a thermal zone device is not found,
> using hwmon->device causes a kernel NULL pointer dereference.
>
> Reported-by: Preble Adam C <[email protected]>
> Signed-off-by: Zhang Rui <[email protected]>
> ---
> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> I'm not sure if the Fix tag applies to such commit or not.

Actually it reverts the work done to encapsulate the thermal zone device
structure.

> ---
> drivers/thermal/thermal_hwmon.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
> index c59db17dddd6..261743f461be 100644
> --- a/drivers/thermal/thermal_hwmon.c
> +++ b/drivers/thermal/thermal_hwmon.c
> @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
> hwmon = thermal_hwmon_lookup_by_type(tz);
> if (unlikely(!hwmon)) {
> /* Should never happen... */
> - dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
> + dev_dbg(&tz->device, "hwmon device lookup failed!\n");

As it 'Should never happen', I would replace that by:

if (WARN_ON(!hwmon))
/* Should never happen... */
return;



> return;
> }
>

--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

2023-03-29 11:04:39

by Rafael J. Wysocki

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
<[email protected]> wrote:
>
> On 29/03/2023 11:00, Zhang Rui wrote:
> > When the hwmon device node of a thermal zone device is not found,
> > using hwmon->device causes a kernel NULL pointer dereference.
> >
> > Reported-by: Preble Adam C <[email protected]>
> > Signed-off-by: Zhang Rui <[email protected]>
> > ---
> > Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> > dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> > I'm not sure if the Fix tag applies to such commit or not.
>
> Actually it reverts the work done to encapsulate the thermal zone device
> structure.
>
> > ---
> > drivers/thermal/thermal_hwmon.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
> > index c59db17dddd6..261743f461be 100644
> > --- a/drivers/thermal/thermal_hwmon.c
> > +++ b/drivers/thermal/thermal_hwmon.c
> > @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
> > hwmon = thermal_hwmon_lookup_by_type(tz);
> > if (unlikely(!hwmon)) {
> > /* Should never happen... */
> > - dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
> > + dev_dbg(&tz->device, "hwmon device lookup failed!\n");
>
> As it 'Should never happen', I would replace that by:
>
> if (WARN_ON(!hwmon))
> /* Should never happen... */
> return;
>

Or just use pr_debug() instead of dev_dbg().

>
> > return;
> > }
> >

2023-03-29 11:27:28

by Zhang, Rui

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, 2023-03-29 at 11:57 +0200, Daniel Lezcano wrote:
> On 29/03/2023 11:00, Zhang Rui wrote:
> > When the hwmon device node of a thermal zone device is not found,
> > using hwmon->device causes a kernel NULL pointer dereference.
> >
> > Reported-by: Preble Adam C <[email protected]>
> > Signed-off-by: Zhang Rui <[email protected]>
> > ---
> > Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal
> > zone structure field")
> > dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> > I'm not sure if the Fix tag applies to such commit or not.
>
> Actually it reverts the work done to encapsulate the thermal zone
> device
> structure.
>
> > ---
> > drivers/thermal/thermal_hwmon.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/thermal/thermal_hwmon.c
> > b/drivers/thermal/thermal_hwmon.c
> > index c59db17dddd6..261743f461be 100644
> > --- a/drivers/thermal/thermal_hwmon.c
> > +++ b/drivers/thermal/thermal_hwmon.c
> > @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct
> > thermal_zone_device *tz)
> > hwmon = thermal_hwmon_lookup_by_type(tz);
> > if (unlikely(!hwmon)) {
> > /* Should never happen... */
> > - dev_dbg(hwmon->device, "hwmon device lookup
> > failed!\n");
> > + dev_dbg(&tz->device, "hwmon device lookup failed!\n");
>
> As it 'Should never happen', I would replace that by:
>
> if (WARN_ON(!hwmon))
> /* Should never happen... */
> return;

Actually, the comment is wrong.

For thermal zones with tzp->no_hwmon set, this is always true.

We should add an extra check for that.

thanks,
rui

2023-03-29 12:08:14

by Rafael J. Wysocki

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, Mar 29, 2023 at 1:24 PM Zhang, Rui <[email protected]> wrote:
>
> On Wed, 2023-03-29 at 11:57 +0200, Daniel Lezcano wrote:
> > On 29/03/2023 11:00, Zhang Rui wrote:
> > > When the hwmon device node of a thermal zone device is not found,
> > > using hwmon->device causes a kernel NULL pointer dereference.
> > >
> > > Reported-by: Preble Adam C <[email protected]>
> > > Signed-off-by: Zhang Rui <[email protected]>
> > > ---
> > > Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal
> > > zone structure field")
> > > dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> > > I'm not sure if the Fix tag applies to such commit or not.
> >
> > Actually it reverts the work done to encapsulate the thermal zone
> > device
> > structure.
> >
> > > ---
> > > drivers/thermal/thermal_hwmon.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/thermal/thermal_hwmon.c
> > > b/drivers/thermal/thermal_hwmon.c
> > > index c59db17dddd6..261743f461be 100644
> > > --- a/drivers/thermal/thermal_hwmon.c
> > > +++ b/drivers/thermal/thermal_hwmon.c
> > > @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct
> > > thermal_zone_device *tz)
> > > hwmon = thermal_hwmon_lookup_by_type(tz);
> > > if (unlikely(!hwmon)) {
> > > /* Should never happen... */
> > > - dev_dbg(hwmon->device, "hwmon device lookup
> > > failed!\n");
> > > + dev_dbg(&tz->device, "hwmon device lookup failed!\n");
> >
> > As it 'Should never happen', I would replace that by:
> >
> > if (WARN_ON(!hwmon))
> > /* Should never happen... */
> > return;
>
> Actually, the comment is wrong.
>
> For thermal zones with tzp->no_hwmon set, this is always true.
>
> We should add an extra check for that.

OK, can you please send a patch fixing all this mess?

2023-03-29 12:12:57

by Rafael J. Wysocki

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
<[email protected]> wrote:
>
> On 29/03/2023 11:00, Zhang Rui wrote:
> > When the hwmon device node of a thermal zone device is not found,
> > using hwmon->device causes a kernel NULL pointer dereference.
> >
> > Reported-by: Preble Adam C <[email protected]>
> > Signed-off-by: Zhang Rui <[email protected]>
> > ---
> > Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> > dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> > I'm not sure if the Fix tag applies to such commit or not.
>
> Actually it reverts the work done to encapsulate the thermal zone device
> structure.

So maybe instead of the wholesale switch to using "driver-specific"
device pointers for printing messages, something like
thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
the first argument can be defined?

At least this particular bug could be avoided this way.

> > ---
> > drivers/thermal/thermal_hwmon.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
> > index c59db17dddd6..261743f461be 100644
> > --- a/drivers/thermal/thermal_hwmon.c
> > +++ b/drivers/thermal/thermal_hwmon.c
> > @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
> > hwmon = thermal_hwmon_lookup_by_type(tz);
> > if (unlikely(!hwmon)) {
> > /* Should never happen... */
> > - dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
> > + dev_dbg(&tz->device, "hwmon device lookup failed!\n");
>
> As it 'Should never happen', I would replace that by:
>
> if (WARN_ON(!hwmon))
> /* Should never happen... */
> return;
>
>
>
> > return;
> > }
> >
>
> --
> <http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs
>
> Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
> <http://twitter.com/#!/linaroorg> Twitter |
> <http://www.linaro.org/linaro-blog/> Blog
>

2023-03-29 12:39:55

by Zhang, Rui

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, 2023-03-29 at 14:06 +0200, Rafael J. Wysocki wrote:
> On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
> <[email protected]> wrote:
> > On 29/03/2023 11:00, Zhang Rui wrote:
> > > When the hwmon device node of a thermal zone device is not found,
> > > using hwmon->device causes a kernel NULL pointer dereference.
> > >
> > > Reported-by: Preble Adam C <[email protected]>
> > > Signed-off-by: Zhang Rui <[email protected]>
> > > ---
> > > Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal
> > > thermal zone structure field")
> > > dec07d399cc8 is a commit in the linux-next branch of linux-pm
> > > repo.
> > > I'm not sure if the Fix tag applies to such commit or not.
> >
> > Actually it reverts the work done to encapsulate the thermal zone
> > device
> > structure.
>
> So maybe instead of the wholesale switch to using "driver-specific"
> device pointers for printing messages, something like
> thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
> the first argument can be defined?
>
> At least this particular bug could be avoided this way.

I didn't see your email before sending patch v2.

are we going to rework the previous series from Daniel thus patch v2 is
no longer needed?

thanks,
rui
>
> > > ---
> > > drivers/thermal/thermal_hwmon.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/thermal/thermal_hwmon.c
> > > b/drivers/thermal/thermal_hwmon.c
> > > index c59db17dddd6..261743f461be 100644
> > > --- a/drivers/thermal/thermal_hwmon.c
> > > +++ b/drivers/thermal/thermal_hwmon.c
> > > @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct
> > > thermal_zone_device *tz)
> > > hwmon = thermal_hwmon_lookup_by_type(tz);
> > > if (unlikely(!hwmon)) {
> > > /* Should never happen... */
> > > - dev_dbg(hwmon->device, "hwmon device lookup
> > > failed!\n");
> > > + dev_dbg(&tz->device, "hwmon device lookup
> > > failed!\n");
> >
> > As it 'Should never happen', I would replace that by:
> >
> > if (WARN_ON(!hwmon))
> > /* Should never happen... */
> > return;
> >
> >
> >
> > > return;
> > > }
> > >
> >
> > --
> > <http://www.linaro.org/> Linaro.org │ Open source software for ARM
> > SoCs
> >
> > Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
> > <http://twitter.com/#!/linaroorg> Twitter |
> > <http://www.linaro.org/linaro-blog/> Blog
> >

2023-03-29 13:54:41

by Rafael J. Wysocki

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, Mar 29, 2023 at 2:33 PM Zhang, Rui <[email protected]> wrote:
>
> On Wed, 2023-03-29 at 14:06 +0200, Rafael J. Wysocki wrote:
> > On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
> > <[email protected]> wrote:
> > > On 29/03/2023 11:00, Zhang Rui wrote:
> > > > When the hwmon device node of a thermal zone device is not found,
> > > > using hwmon->device causes a kernel NULL pointer dereference.
> > > >
> > > > Reported-by: Preble Adam C <[email protected]>
> > > > Signed-off-by: Zhang Rui <[email protected]>
> > > > ---
> > > > Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal
> > > > thermal zone structure field")
> > > > dec07d399cc8 is a commit in the linux-next branch of linux-pm
> > > > repo.
> > > > I'm not sure if the Fix tag applies to such commit or not.
> > >
> > > Actually it reverts the work done to encapsulate the thermal zone
> > > device
> > > structure.
> >
> > So maybe instead of the wholesale switch to using "driver-specific"
> > device pointers for printing messages, something like
> > thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
> > the first argument can be defined?
> >
> > At least this particular bug could be avoided this way.
>
> I didn't see your email before sending patch v2.
>
> are we going to rework the previous series from Daniel thus patch v2 is
> no longer needed?

Well, let's see what Daniel says..

In any case, though, it is not very useful to carry an obvious NULL
pointer dereference in linux-next and the pr_debug() statement added
by the v2 can be replaced later, so I think I'll apply it.

2023-03-29 14:19:52

by Daniel Lezcano

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On 29/03/2023 14:06, Rafael J. Wysocki wrote:
> On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
> <[email protected]> wrote:
>>
>> On 29/03/2023 11:00, Zhang Rui wrote:
>>> When the hwmon device node of a thermal zone device is not found,
>>> using hwmon->device causes a kernel NULL pointer dereference.
>>>
>>> Reported-by: Preble Adam C <[email protected]>
>>> Signed-off-by: Zhang Rui <[email protected]>
>>> ---
>>> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
>>> dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
>>> I'm not sure if the Fix tag applies to such commit or not.
>>
>> Actually it reverts the work done to encapsulate the thermal zone device
>> structure.
>
> So maybe instead of the wholesale switch to using "driver-specific"
> device pointers for printing messages, something like
> thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
> the first argument can be defined?
>
> At least this particular bug could be avoided this way.

Actually we previously said the thermal_hwmon can be considered as part
of the thermal core code, so we can keep using tz->device.

I'll drop this change from the series.

On the other side, adding more thermal_zone_debug/info.. gives
opportunities to external components of the core thermal framework to
write thermal zone device related message. I'm not sure that is a good
thing, each writer should stay in its namespace, no ?

>>> ---
>>> drivers/thermal/thermal_hwmon.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
>>> index c59db17dddd6..261743f461be 100644
>>> --- a/drivers/thermal/thermal_hwmon.c
>>> +++ b/drivers/thermal/thermal_hwmon.c
>>> @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
>>> hwmon = thermal_hwmon_lookup_by_type(tz);
>>> if (unlikely(!hwmon)) {
>>> /* Should never happen... */
>>> - dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
>>> + dev_dbg(&tz->device, "hwmon device lookup failed!\n");
>>
>> As it 'Should never happen', I would replace that by:
>>
>> if (WARN_ON(!hwmon))
>> /* Should never happen... */
>> return;
>>
>>
>>
>>> return;
>>> }
>>>
>>
>> --
>> <http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs
>>
>> Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
>> <http://twitter.com/#!/linaroorg> Twitter |
>> <http://www.linaro.org/linaro-blog/> Blog
>>

--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

2023-03-29 14:44:35

by Rafael J. Wysocki

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, Mar 29, 2023 at 4:16 PM Daniel Lezcano
<[email protected]> wrote:
>
> On 29/03/2023 14:06, Rafael J. Wysocki wrote:
> > On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
> > <[email protected]> wrote:
> >>
> >> On 29/03/2023 11:00, Zhang Rui wrote:
> >>> When the hwmon device node of a thermal zone device is not found,
> >>> using hwmon->device causes a kernel NULL pointer dereference.
> >>>
> >>> Reported-by: Preble Adam C <[email protected]>
> >>> Signed-off-by: Zhang Rui <[email protected]>
> >>> ---
> >>> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> >>> dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> >>> I'm not sure if the Fix tag applies to such commit or not.
> >>
> >> Actually it reverts the work done to encapsulate the thermal zone device
> >> structure.
> >
> > So maybe instead of the wholesale switch to using "driver-specific"
> > device pointers for printing messages, something like
> > thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
> > the first argument can be defined?
> >
> > At least this particular bug could be avoided this way.
>
> Actually we previously said the thermal_hwmon can be considered as part
> of the thermal core code, so we can keep using tz->device.
>
> I'll drop this change from the series.

But it's there in my thermal branch already.

Do you want to revert the thermal_hwmon.c part of commit dec07d399cc8?

> On the other side, adding more thermal_zone_debug/info.. gives
> opportunities to external components of the core thermal framework to
> write thermal zone device related message. I'm not sure that is a good
> thing, each writer should stay in its namespace, no ?

IMV whoever is allowed to use a thermal zone pointer should also be
allowed to print messages related to its use, especially debug ones.

"Encapsulation" means that the members of a thermal zone device object
should not be accessed directly by its users other than the core, not
that it cannot be used as a message tag.

2023-03-29 16:03:21

by Daniel Lezcano

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On 29/03/2023 16:38, Rafael J. Wysocki wrote:
> On Wed, Mar 29, 2023 at 4:16 PM Daniel Lezcano
> <[email protected]> wrote:
>>
>> On 29/03/2023 14:06, Rafael J. Wysocki wrote:
>>> On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
>>> <[email protected]> wrote:
>>>>
>>>> On 29/03/2023 11:00, Zhang Rui wrote:
>>>>> When the hwmon device node of a thermal zone device is not found,
>>>>> using hwmon->device causes a kernel NULL pointer dereference.
>>>>>
>>>>> Reported-by: Preble Adam C <[email protected]>
>>>>> Signed-off-by: Zhang Rui <[email protected]>
>>>>> ---
>>>>> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
>>>>> dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
>>>>> I'm not sure if the Fix tag applies to such commit or not.
>>>>
>>>> Actually it reverts the work done to encapsulate the thermal zone device
>>>> structure.
>>>
>>> So maybe instead of the wholesale switch to using "driver-specific"
>>> device pointers for printing messages, something like
>>> thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
>>> the first argument can be defined?
>>>
>>> At least this particular bug could be avoided this way.
>>
>> Actually we previously said the thermal_hwmon can be considered as part
>> of the thermal core code, so we can keep using tz->device.
>>
>> I'll drop this change from the series.
>
> But it's there in my thermal branch already.
>
> Do you want to revert the thermal_hwmon.c part of commit dec07d399cc8?

Oh, right. Fair enough.

I think Rui's patch is fine then.


>> On the other side, adding more thermal_zone_debug/info.. gives
>> opportunities to external components of the core thermal framework to
>> write thermal zone device related message. I'm not sure that is a good
>> thing, each writer should stay in its namespace, no ?
>
> IMV whoever is allowed to use a thermal zone pointer should also be
> allowed to print messages related to its use, especially debug ones.
>
> "Encapsulation" means that the members of a thermal zone device object
> should not be accessed directly by its users other than the core, not
> that it cannot be used as a message tag.

Actually it is not about the encapsulation but the namespace of the
messages. If a driver has an issue, IMO it is better it uses the device
related messages and let thermal zone messages to be related to what is
happening in the thermal framework, not in the back end.



--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

2023-03-29 16:05:47

by Daniel Lezcano

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On 29/03/2023 11:00, Zhang Rui wrote:
> When the hwmon device node of a thermal zone device is not found,
> using hwmon->device causes a kernel NULL pointer dereference.
>
> Reported-by: Preble Adam C <[email protected]>
> Signed-off-by: Zhang Rui <[email protected]>

Acked-by: Daniel Lezcano <[email protected]>

> ---
> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> I'm not sure if the Fix tag applies to such commit or not.
> ---
> drivers/thermal/thermal_hwmon.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
> index c59db17dddd6..261743f461be 100644
> --- a/drivers/thermal/thermal_hwmon.c
> +++ b/drivers/thermal/thermal_hwmon.c
> @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
> hwmon = thermal_hwmon_lookup_by_type(tz);
> if (unlikely(!hwmon)) {
> /* Should never happen... */
> - dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
> + dev_dbg(&tz->device, "hwmon device lookup failed!\n");
> return;
> }
>

--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

2023-03-29 16:07:18

by Rafael J. Wysocki

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, Mar 29, 2023 at 5:59 PM Daniel Lezcano
<[email protected]> wrote:
>
> On 29/03/2023 16:38, Rafael J. Wysocki wrote:
> > On Wed, Mar 29, 2023 at 4:16 PM Daniel Lezcano
> > <[email protected]> wrote:
> >>
> >> On 29/03/2023 14:06, Rafael J. Wysocki wrote:
> >>> On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
> >>> <[email protected]> wrote:
> >>>>
> >>>> On 29/03/2023 11:00, Zhang Rui wrote:
> >>>>> When the hwmon device node of a thermal zone device is not found,
> >>>>> using hwmon->device causes a kernel NULL pointer dereference.
> >>>>>
> >>>>> Reported-by: Preble Adam C <[email protected]>
> >>>>> Signed-off-by: Zhang Rui <[email protected]>
> >>>>> ---
> >>>>> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> >>>>> dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> >>>>> I'm not sure if the Fix tag applies to such commit or not.
> >>>>
> >>>> Actually it reverts the work done to encapsulate the thermal zone device
> >>>> structure.
> >>>
> >>> So maybe instead of the wholesale switch to using "driver-specific"
> >>> device pointers for printing messages, something like
> >>> thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
> >>> the first argument can be defined?
> >>>
> >>> At least this particular bug could be avoided this way.
> >>
> >> Actually we previously said the thermal_hwmon can be considered as part
> >> of the thermal core code, so we can keep using tz->device.
> >>
> >> I'll drop this change from the series.
> >
> > But it's there in my thermal branch already.
> >
> > Do you want to revert the thermal_hwmon.c part of commit dec07d399cc8?
>
> Oh, right. Fair enough.
>
> I think Rui's patch is fine then.

I guess you mean the $subject one, that is:

https://patchwork.kernel.org/project/linux-pm/patch/[email protected]

What about the message printed when temp is NULL. Should the original
form of it be restored too?


> >> On the other side, adding more thermal_zone_debug/info.. gives
> >> opportunities to external components of the core thermal framework to
> >> write thermal zone device related message. I'm not sure that is a good
> >> thing, each writer should stay in its namespace, no ?
> >
> > IMV whoever is allowed to use a thermal zone pointer should also be
> > allowed to print messages related to its use, especially debug ones.
> >
> > "Encapsulation" means that the members of a thermal zone device object
> > should not be accessed directly by its users other than the core, not
> > that it cannot be used as a message tag.
>
> Actually it is not about the encapsulation but the namespace of the
> messages. If a driver has an issue, IMO it is better it uses the device
> related messages and let thermal zone messages to be related to what is
> happening in the thermal framework, not in the back end.
>
>
>
> --
> <http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs
>
> Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
> <http://twitter.com/#!/linaroorg> Twitter |
> <http://www.linaro.org/linaro-blog/> Blog
>

2023-03-29 16:21:13

by Daniel Lezcano

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On 29/03/2023 18:03, Rafael J. Wysocki wrote:
> On Wed, Mar 29, 2023 at 5:59 PM Daniel Lezcano
> <[email protected]> wrote:
>>
>> On 29/03/2023 16:38, Rafael J. Wysocki wrote:
>>> On Wed, Mar 29, 2023 at 4:16 PM Daniel Lezcano
>>> <[email protected]> wrote:
>>>>
>>>> On 29/03/2023 14:06, Rafael J. Wysocki wrote:
>>>>> On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
>>>>> <[email protected]> wrote:
>>>>>>
>>>>>> On 29/03/2023 11:00, Zhang Rui wrote:
>>>>>>> When the hwmon device node of a thermal zone device is not found,
>>>>>>> using hwmon->device causes a kernel NULL pointer dereference.
>>>>>>>
>>>>>>> Reported-by: Preble Adam C <[email protected]>
>>>>>>> Signed-off-by: Zhang Rui <[email protected]>
>>>>>>> ---
>>>>>>> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
>>>>>>> dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
>>>>>>> I'm not sure if the Fix tag applies to such commit or not.
>>>>>>
>>>>>> Actually it reverts the work done to encapsulate the thermal zone device
>>>>>> structure.
>>>>>
>>>>> So maybe instead of the wholesale switch to using "driver-specific"
>>>>> device pointers for printing messages, something like
>>>>> thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
>>>>> the first argument can be defined?
>>>>>
>>>>> At least this particular bug could be avoided this way.
>>>>
>>>> Actually we previously said the thermal_hwmon can be considered as part
>>>> of the thermal core code, so we can keep using tz->device.
>>>>
>>>> I'll drop this change from the series.
>>>
>>> But it's there in my thermal branch already.
>>>
>>> Do you want to revert the thermal_hwmon.c part of commit dec07d399cc8?
>>
>> Oh, right. Fair enough.
>>
>> I think Rui's patch is fine then.
>
> I guess you mean the $subject one, that is:
>
> https://patchwork.kernel.org/project/linux-pm/patch/[email protected]

Correct

> What about the message printed when temp is NULL. Should the original
> form of it be restored too?

Yes, you are right, for the sake of consistency we should restore also
this one.



--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

2023-03-29 17:08:26

by Rafael J. Wysocki

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, Mar 29, 2023 at 6:03 PM Daniel Lezcano
<[email protected]> wrote:
>
> On 29/03/2023 11:00, Zhang Rui wrote:
> > When the hwmon device node of a thermal zone device is not found,
> > using hwmon->device causes a kernel NULL pointer dereference.
> >
> > Reported-by: Preble Adam C <[email protected]>
> > Signed-off-by: Zhang Rui <[email protected]>
>
> Acked-by: Daniel Lezcano <[email protected]>

Applied, thanks!

> > ---
> > Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> > dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> > I'm not sure if the Fix tag applies to such commit or not.
> > ---
> > drivers/thermal/thermal_hwmon.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
> > index c59db17dddd6..261743f461be 100644
> > --- a/drivers/thermal/thermal_hwmon.c
> > +++ b/drivers/thermal/thermal_hwmon.c
> > @@ -229,7 +229,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
> > hwmon = thermal_hwmon_lookup_by_type(tz);
> > if (unlikely(!hwmon)) {
> > /* Should never happen... */
> > - dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
> > + dev_dbg(&tz->device, "hwmon device lookup failed!\n");
> > return;
> > }
> >
>
> --
> <http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs
>
> Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
> <http://twitter.com/#!/linaroorg> Twitter |
> <http://www.linaro.org/linaro-blog/> Blog
>

2023-03-29 17:45:08

by Rafael J. Wysocki

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wednesday, March 29, 2023 6:18:31 PM CEST Daniel Lezcano wrote:
> On 29/03/2023 18:03, Rafael J. Wysocki wrote:
> > On Wed, Mar 29, 2023 at 5:59 PM Daniel Lezcano
> > <[email protected]> wrote:
> >>
> >> On 29/03/2023 16:38, Rafael J. Wysocki wrote:
> >>> On Wed, Mar 29, 2023 at 4:16 PM Daniel Lezcano
> >>> <[email protected]> wrote:
> >>>>
> >>>> On 29/03/2023 14:06, Rafael J. Wysocki wrote:
> >>>>> On Wed, Mar 29, 2023 at 11:57 AM Daniel Lezcano
> >>>>> <[email protected]> wrote:
> >>>>>>
> >>>>>> On 29/03/2023 11:00, Zhang Rui wrote:
> >>>>>>> When the hwmon device node of a thermal zone device is not found,
> >>>>>>> using hwmon->device causes a kernel NULL pointer dereference.
> >>>>>>>
> >>>>>>> Reported-by: Preble Adam C <[email protected]>
> >>>>>>> Signed-off-by: Zhang Rui <[email protected]>
> >>>>>>> ---
> >>>>>>> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> >>>>>>> dec07d399cc8 is a commit in the linux-next branch of linux-pm repo.
> >>>>>>> I'm not sure if the Fix tag applies to such commit or not.
> >>>>>>
> >>>>>> Actually it reverts the work done to encapsulate the thermal zone device
> >>>>>> structure.
> >>>>>
> >>>>> So maybe instead of the wholesale switch to using "driver-specific"
> >>>>> device pointers for printing messages, something like
> >>>>> thermal_zone_debug/info/warn/error() taking a thermal zone pointer as
> >>>>> the first argument can be defined?
> >>>>>
> >>>>> At least this particular bug could be avoided this way.
> >>>>
> >>>> Actually we previously said the thermal_hwmon can be considered as part
> >>>> of the thermal core code, so we can keep using tz->device.
> >>>>
> >>>> I'll drop this change from the series.
> >>>
> >>> But it's there in my thermal branch already.
> >>>
> >>> Do you want to revert the thermal_hwmon.c part of commit dec07d399cc8?
> >>
> >> Oh, right. Fair enough.
> >>
> >> I think Rui's patch is fine then.
> >
> > I guess you mean the $subject one, that is:
> >
> > https://patchwork.kernel.org/project/linux-pm/patch/[email protected]
>
> Correct
>
> > What about the message printed when temp is NULL. Should the original
> > form of it be restored too?
>
> Yes, you are right, for the sake of consistency we should restore also
> this one.

So I'm going to apply the appended patch.

Please let me know if there are any concerns regarding it.

---
From: Rafael J. Wysocki <[email protected]>
Subject: [PATCH] thermal: thermal_hwmon: Revert recent message adjustment

For the sake of consistency, revert the second part of the
thermal_hwmon.c hunk from commit dec07d399cc8 ("thermal: Don't use
'device' internal thermal zone structure field") after the first
part of it has been reverted.

Link: https://lore.kernel.org/linux-pm/[email protected]
Signed-off-by: Rafael J. Wysocki <[email protected]>
---
drivers/thermal/thermal_hwmon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Index: linux-pm/drivers/thermal/thermal_hwmon.c
===================================================================
--- linux-pm.orig/drivers/thermal/thermal_hwmon.c
+++ linux-pm/drivers/thermal/thermal_hwmon.c
@@ -236,7 +236,7 @@ void thermal_remove_hwmon_sysfs(struct t
temp = thermal_hwmon_lookup_temp(hwmon, tz);
if (unlikely(!temp)) {
/* Should never happen... */
- dev_dbg(hwmon->device, "temperature input lookup failed!\n");
+ dev_dbg(&tz->device, "temperature input lookup failed!\n");
return;
}




2023-03-29 18:40:38

by Daniel Lezcano

[permalink] [raw]
Subject: Re: [PATCH -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On 29/03/2023 19:43, Rafael J. Wysocki wrote:

[ ... ]

>>> What about the message printed when temp is NULL. Should the original
>>> form of it be restored too?
>>
>> Yes, you are right, for the sake of consistency we should restore also
>> this one.
>
> So I'm going to apply the appended patch.
>
> Please let me know if there are any concerns regarding it.
>
> ---
> From: Rafael J. Wysocki <[email protected]>
> Subject: [PATCH] thermal: thermal_hwmon: Revert recent message adjustment
>
> For the sake of consistency, revert the second part of the
> thermal_hwmon.c hunk from commit dec07d399cc8 ("thermal: Don't use
> 'device' internal thermal zone structure field") after the first
> part of it has been reverted.
>
> Link: https://lore.kernel.org/linux-pm/[email protected]
> Signed-off-by: Rafael J. Wysocki <[email protected]>

Acked-by: Daniel Lezcano <[email protected]>


> ---
> drivers/thermal/thermal_hwmon.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> Index: linux-pm/drivers/thermal/thermal_hwmon.c
> ===================================================================
> --- linux-pm.orig/drivers/thermal/thermal_hwmon.c
> +++ linux-pm/drivers/thermal/thermal_hwmon.c
> @@ -236,7 +236,7 @@ void thermal_remove_hwmon_sysfs(struct t
> temp = thermal_hwmon_lookup_temp(hwmon, tz);
> if (unlikely(!temp)) {
> /* Should never happen... */
> - dev_dbg(hwmon->device, "temperature input lookup failed!\n");
> + dev_dbg(&tz->device, "temperature input lookup failed!\n");
> return;
> }


--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog