From nobody Mon Jun 8 06:36:19 2026 Received: from mail-qk1-f173.google.com (mail-qk1-f173.google.com [209.85.222.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 065ED3AB5DE for ; Fri, 5 Jun 2026 18:52:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780685538; cv=none; b=hYI4FClPatBBWSLqg0CuSLAfv+Na4mmyaupZjsDyrYWoyEBMEsTTm8a0OrdQLqVS9VvzXMo9SoeMAfM8qao/ZTz2ocDgfYHrMynG6Zr0CyqFW0gh05YhMFnkon/nm/igiiF9Jsv2spimxgJbSo/j4tTdRPclue+q5ZGzmZP7V0c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780685538; c=relaxed/simple; bh=eGLfgooD3RclyjxpuXQAqPJd4HJZjhE/q8GxTYHASdw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=CT0QbufnPZ7K4B0vAHHVQ0VG1mKpnqzFFOTW2EvZYHwevucMySne6lVYwGtr5mPXxMcCm2TVY9FxMh8fkxftyrI1IIm1Q+YanP1pdQOINXcOErJEXB70RF+8S2O+AJZuuueGUxXrr4LCaM/tojZgrW/D93E5EqCmRnSNTVRxua4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=LHaCcBZi; arc=none smtp.client-ip=209.85.222.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="LHaCcBZi" Received: by mail-qk1-f173.google.com with SMTP id af79cd13be357-91562bf6c12so303636085a.2 for ; Fri, 05 Jun 2026 11:52:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1780685536; x=1781290336; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=xA3NPLxNbbGWMb5I0aDm8qwgxStiKGOjgeHXeyzNN7o=; b=LHaCcBZiezh5I+apGY9x380ooaq5qsP7f2XZbLK1A9iou4tcenDrU1OasaVzlSedaC +X8dJtLxJORfP4XwRiQwga66Kqeo9PWKxmV8WpvxKR7x3Kp1zi4B+GkbwpEcHJz8rqBO eECfRRjWJb8bM4zqV6ZrxSOS3DzVqgHecjFbOOvAijAsm+PoU1zkxdeJNEmNocusXMhn 2rQ6M8t9vHJjWwjM6+LjXEbK9+q5eqLJtGjotH1naG8EZE6Vf1TqPbQnmty8d3FOY6HO WKbOTuqNFN5Mtxi+1d9IJTmpvPCN4txEafa1hDs6xbfNiNtX6QGbNc4vs5GVwBlmx2qW pIGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780685536; x=1781290336; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=xA3NPLxNbbGWMb5I0aDm8qwgxStiKGOjgeHXeyzNN7o=; b=k5Hsl6hPqVuf89wqQukQ4H2NshhuYmyNfTWz1LtNBtKnm7GrSwAbqXAGf7h+2l6HHz klqZZIZFY07YMDeP3/VpUmthi5kb5mpDCMD9He/3N+d0868O+02YJTBa2hmgvN0YqU/W mIUVbbKU5HZeUbnXgaEcplnfLU5I6uMw0mXgQItWbCPqzsp/0fQhEBdASe1KI3hDdvZG Lfah2qRgCVwCpLJ+FSc/2x8u+eH7cDQm+b5f53iDTZ5lloL6wgscwzcwB9feN4khuaVr DMqzmZ7SKwAEnLbgA1leXvjFvjBqXJKpvUxw2IZ7i4ztbTVd/Fd+b1N3vS+HuYGSYHZO CECw== X-Forwarded-Encrypted: i=1; AFNElJ+GCUsi/gqHJaN3tdy1Hevys62vOCMWKKwhaOZd7K6wMKtrP9jKBrgBQz0VtxLNUk4QpHmLEBXDpwy20J8=@vger.kernel.org X-Gm-Message-State: AOJu0YwZsUR7HCpDkEzGk5+dHbLZCGiSmlsOSdDBCl2laRmEEL37Smxw S7W+cT2hPhaMNZntlN6cj9Fa2MhGZdpCV8opusJBvw6cD/A6YwM0CDjm42wMOMJCwJ8= X-Gm-Gg: Acq92OHnn8XmUSUheOFhugo54TWpDGMyv6G3e8RTcIN+/Sq03j7QoNg1qc9LR7f7Bw6 jMd+79JtUrdbjaNlYyDwpJrN5m9wrT1XyZEEIg1/gT4k6Fa8eVTfumo63BfMPkqz2Xz8GGYynjM NeJy5JTnZDsYvKcRwtS88qimoJk/MBqataHF/Pvr++U5PGCWWXn0W4PQSYkG8jWYrVqfoHaE5hN QQQ6Sw6kLc8n6rO5Bc9V+EfYf2FuTPcu4xaOUIT3CgMDRQeigK0nA2zC9d4ngHCoQ4Qhv+Iomfo t/rbovGQLNag+b9LllYaP2fDMKD4ZK/IpV18PVcIKwi/HKKG5fp+x80ozkq5SKlPDffHDPhM/1m WV7f3cyUtCq/hHtWRMrU9uHj++ubBNgy6hBsRi0+9vlcTauGrjdFAyXo+xwwAu2N/S8XUVcQiAI aWOkiMYGXR/jIQWlfN9DO7JrpWmBZFTgAbz82YWQ== X-Received: by 2002:a05:620a:440d:b0:915:92bf:560f with SMTP id af79cd13be357-915a9d6bc64mr869842585a.36.1780685535919; Fri, 05 Jun 2026 11:52:15 -0700 (PDT) Received: from localhost ([161.35.96.86]) by smtp.gmail.com with UTF8SMTPSA id af79cd13be357-915a6935cd8sm480356885a.21.2026.06.05.11.52.14 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 05 Jun 2026 11:52:15 -0700 (PDT) From: Samuel Moelius To: "Rafael J. Wysocki" Cc: Samuel Moelius , Daniel Lezcano , Zhang Rui , Lukasz Luba , Al Viro , Greg Kroah-Hartman , linux-pm@vger.kernel.org (open list:THERMAL), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] thermal: testing: reject missing command arguments Date: Fri, 5 Jun 2026 18:52:06 +0000 Message-ID: <20260605185212.2491144-1-sam.moelius@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The thermal testing debugfs command parser splits commands at ':' and passes the right-hand side to the command implementation. Commands such as deltz, tzaddtrip, tzreg, and tzunreg require a zone id, but writing one of those command names without ':' leaves the argument pointer NULL. The command implementations parse the id with sscanf(arg, "%d", ...), so the missing-argument form dereferences a NULL pointer from the debugfs write path. Reject missing arguments in tt_command_exec() before calling handlers that require an id. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius --- drivers/thermal/testing/command.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/thermal/testing/command.c b/drivers/thermal/testing/co= mmand.c index 1159ecea57e7..fbf7ab9729b5 100644 --- a/drivers/thermal/testing/command.c +++ b/drivers/thermal/testing/command.c @@ -116,18 +116,30 @@ static int tt_command_exec(int index, const char *arg) break; =20 case TT_CMD_DELTZ: + if (!arg || !*arg) + return -EINVAL; + ret =3D tt_del_tz(arg); break; =20 case TT_CMD_TZADDTRIP: + if (!arg || !*arg) + return -EINVAL; + ret =3D tt_zone_add_trip(arg); break; =20 case TT_CMD_TZREG: + if (!arg || !*arg) + return -EINVAL; + ret =3D tt_zone_reg(arg); break; =20 case TT_CMD_TZUNREG: + if (!arg || !*arg) + return -EINVAL; + ret =3D tt_zone_unreg(arg); break; =20 --=20 2.43.0