thermal: tegra: Fix dereference of pointer tz before it is null checked

[PATCH][next] thermal: tegra: Fix dereference of pointer tz before it is null checked

Posted by Colin Ian King 2 months, 1 week ago

Currently pointer tz is dereferenced before it is being null checked
leading to a potential null pointer deferernce issue. Fix this by
only defererencing it once it has been null checked.

Fixes: 6fc2e1a5f98f ("thermal/drivers/tegra: Switch to new of API")

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
---
 drivers/thermal/tegra/soctherm.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
index 53a5c649f4b1..53fa6099b67f 100644
--- a/drivers/thermal/tegra/soctherm.c
+++ b/drivers/thermal/tegra/soctherm.c
@@ -585,14 +585,19 @@ static int tsensor_group_thermtrip_get(struct tegra_soctherm *ts, int id)
 static int tegra_thermctl_set_trip_temp(struct thermal_zone_device *tz,
 					const struct thermal_trip *trip, int temp)
 {
-	struct tegra_thermctl_zone *zone = thermal_zone_device_priv(tz);
-	struct tegra_soctherm *ts = zone->ts;
-	const struct tegra_tsensor_group *sg = zone->sg;
-	struct device *dev = zone->dev;
+	struct tegra_thermctl_zone *zone;
+	struct tegra_soctherm *ts;
+	const struct tegra_tsensor_group *sg;
+	struct device *dev;
 
 	if (!tz)
 		return -EINVAL;
 
+	zone = thermal_zone_device_priv(tz);
+	ts = zone->ts;
+	sg = zone->sg;
+	dev = zone->dev;
+
 	if (trip->type == THERMAL_TRIP_CRITICAL) {
 		/*
 		 * If thermtrips property is set in DT,
-- 
2.50.0

Re: [PATCH][next] thermal: tegra: Fix dereference of pointer tz before it is null checked

Posted by Daniel Lezcano 2 months ago

On 30/07/2025 15:54, Colin Ian King wrote:
> Currently pointer tz is dereferenced before it is being null checked
> leading to a potential null pointer deferernce issue. Fix this by
> only defererencing it once it has been null checked.

Actually the callback should assume tz is never NULL because the caller 
does:

	ret = tz->ops.set_trip_temp(tz, trip, temp);

So removing the NULL pointer check is safe here.


> Fixes: 6fc2e1a5f98f ("thermal/drivers/tegra: Switch to new of API")
> 
> Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
> ---
>   drivers/thermal/tegra/soctherm.c | 13 +++++++++----
>   1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
> index 53a5c649f4b1..53fa6099b67f 100644
> --- a/drivers/thermal/tegra/soctherm.c
> +++ b/drivers/thermal/tegra/soctherm.c
> @@ -585,14 +585,19 @@ static int tsensor_group_thermtrip_get(struct tegra_soctherm *ts, int id)
>   static int tegra_thermctl_set_trip_temp(struct thermal_zone_device *tz,
>   					const struct thermal_trip *trip, int temp)
>   {
> -	struct tegra_thermctl_zone *zone = thermal_zone_device_priv(tz);
> -	struct tegra_soctherm *ts = zone->ts;
> -	const struct tegra_tsensor_group *sg = zone->sg;
> -	struct device *dev = zone->dev;
> +	struct tegra_thermctl_zone *zone;
> +	struct tegra_soctherm *ts;
> +	const struct tegra_tsensor_group *sg;
> +	struct device *dev;
>   
>   	if (!tz)
>   		return -EINVAL;
>   
> +	zone = thermal_zone_device_priv(tz);
> +	ts = zone->ts;
> +	sg = zone->sg;
> +	dev = zone->dev;
> +
>   	if (trip->type == THERMAL_TRIP_CRITICAL) {
>   		/*
>   		 * If thermtrips property is set in DT,


-- 
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog

Re: [PATCH][next] thermal: tegra: Fix dereference of pointer tz before it is null checked

Posted by Markus Elfring 2 months, 1 week ago

> Currently pointer tz is dereferenced before it is being null checked
> leading to a potential null pointer deferernce issue. Fix this by
…
                                      dereference?

Regards,
Markus

Re: [PATCH][next] thermal: tegra: Fix dereference of pointer tz before it is null checked

Posted by Colin King (gmail) 2 months ago

Shall I send a V2, or can this be fixed up when it's applied?

On 30/07/2025 18:43, Markus Elfring wrote:
>> Currently pointer tz is dereferenced before it is being null checked
>> leading to a potential null pointer deferernce issue. Fix this by
> …
>                                        dereference?
> 
> Regards,
> Markus