2023-03-29 12:37:27

by Zhang, Rui

Subject: [PATCH v2 -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

When the hwmon device node of a thermal zone device is not found,
using hwmon->device causes a kernel NULL pointer dereference.

Skip removing hwmon device for thermal zones without hwmon device, and
fix the kernel NULL pointer dereference when hwmon device is not found.

Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
Reported-by: Preble Adam C <[email protected]>
Signed-off-by: Zhang Rui <[email protected]>
---
v1 -> v2
Add check for devices without hwmon device.
Use pr_debug instead of dev_dbg.
---
drivers/thermal/thermal_hwmon.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index c59db17dddd6..1cdee2ee8d4d 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -226,10 +226,12 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
struct thermal_hwmon_device *hwmon;
struct thermal_hwmon_temp *temp;

+ if (tz->tzp && tz->tzp->no_hwmon)
+ return;
+
hwmon = thermal_hwmon_lookup_by_type(tz);
if (unlikely(!hwmon)) {
- /* Should never happen... */
- dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
+ pr_debug("hwmon device lookup failed!\n");
return;
}

--
2.25.1

2023-03-29 13:58:34

by Rafael J. Wysocki

Subject: Re: [PATCH v2 -next] thermal/drivers/thermal_hwmon: Fix a kernel NULL pointer dereference

On Wed, Mar 29, 2023 at 2:26 PM Zhang Rui <[email protected]> wrote:
>
> When the hwmon device node of a thermal zone device is not found,
> using hwmon->device causes a kernel NULL pointer dereference.
>
> Skip removing hwmon device for thermal zones without hwmon device, and
> fix the kernel NULL pointer dereference when hwmon device is not found.
>
> Fixes: dec07d399cc8 ("thermal: Don't use 'device' internal thermal zone structure field")
> Reported-by: Preble Adam C <[email protected]>

Do you have a link to the bug report? I'm wondering where exactly it triggers.

> Signed-off-by: Zhang Rui <[email protected]>
> ---
> v1 -> v2
> Add check for devices without hwmon device.
> Use pr_debug instead of dev_dbg.
> ---
> drivers/thermal/thermal_hwmon.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
> index c59db17dddd6..1cdee2ee8d4d 100644
> --- a/drivers/thermal/thermal_hwmon.c
> +++ b/drivers/thermal/thermal_hwmon.c
> @@ -226,10 +226,12 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
> struct thermal_hwmon_device *hwmon;
> struct thermal_hwmon_temp *temp;
>
> + if (tz->tzp && tz->tzp->no_hwmon)
> + return;
> +
> hwmon = thermal_hwmon_lookup_by_type(tz);
> if (unlikely(!hwmon)) {
> - /* Should never happen... */
> - dev_dbg(hwmon->device, "hwmon device lookup failed!\n");
> + pr_debug("hwmon device lookup failed!\n");
> return;
> }
>
> --