Commit 7931e280 authored by Lee, Chun-Yi's avatar Lee, Chun-Yi Committed by Rafael J. Wysocki

thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR

In some case, the GDDV returns a package with a buffer which has
zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10).

Then the data_vault_read() got NULL point dereference problem when
accessing the 0x10 value in data_vault.

[   71.024560] BUG: kernel NULL pointer dereference, address:
0000000000000010

This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or
NULL value in data_vault.
Signed-off-by: default avatar"Lee, Chun-Yi" <jlee@suse.com>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent 1c23f9e6
...@@ -527,7 +527,7 @@ static void int3400_setup_gddv(struct int3400_thermal_priv *priv) ...@@ -527,7 +527,7 @@ static void int3400_setup_gddv(struct int3400_thermal_priv *priv)
priv->data_vault = kmemdup(obj->package.elements[0].buffer.pointer, priv->data_vault = kmemdup(obj->package.elements[0].buffer.pointer,
obj->package.elements[0].buffer.length, obj->package.elements[0].buffer.length,
GFP_KERNEL); GFP_KERNEL);
if (!priv->data_vault) if (ZERO_OR_NULL_PTR(priv->data_vault))
goto out_free; goto out_free;
bin_attr_data_vault.private = priv->data_vault; bin_attr_data_vault.private = priv->data_vault;
...@@ -597,7 +597,7 @@ static int int3400_thermal_probe(struct platform_device *pdev) ...@@ -597,7 +597,7 @@ static int int3400_thermal_probe(struct platform_device *pdev)
goto free_imok; goto free_imok;
} }
if (priv->data_vault) { if (!ZERO_OR_NULL_PTR(priv->data_vault)) {
result = sysfs_create_group(&pdev->dev.kobj, result = sysfs_create_group(&pdev->dev.kobj,
&data_attribute_group); &data_attribute_group);
if (result) if (result)
...@@ -615,7 +615,8 @@ static int int3400_thermal_probe(struct platform_device *pdev) ...@@ -615,7 +615,8 @@ static int int3400_thermal_probe(struct platform_device *pdev)
free_sysfs: free_sysfs:
cleanup_odvp(priv); cleanup_odvp(priv);
if (priv->data_vault) { if (priv->data_vault) {
sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group); if (!ZERO_OR_NULL_PTR(priv->data_vault))
sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group);
kfree(priv->data_vault); kfree(priv->data_vault);
} }
free_uuid: free_uuid:
...@@ -647,7 +648,7 @@ static int int3400_thermal_remove(struct platform_device *pdev) ...@@ -647,7 +648,7 @@ static int int3400_thermal_remove(struct platform_device *pdev)
if (!priv->rel_misc_dev_res) if (!priv->rel_misc_dev_res)
acpi_thermal_rel_misc_device_remove(priv->adev->handle); acpi_thermal_rel_misc_device_remove(priv->adev->handle);
if (priv->data_vault) if (!ZERO_OR_NULL_PTR(priv->data_vault))
sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group); sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group);
sysfs_remove_group(&pdev->dev.kobj, &uuid_attribute_group); sysfs_remove_group(&pdev->dev.kobj, &uuid_attribute_group);
sysfs_remove_group(&pdev->dev.kobj, &imok_attribute_group); sysfs_remove_group(&pdev->dev.kobj, &imok_attribute_group);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment