linux-kernel - Re: [PATCH][next] thermal: tegra: Fix dereference of pointer tz before it is null checked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d29b1e05-f783-44ed-a2e3-585a191ec426@linaro.org>
Date: Fri, 1 Aug 2025 19:22:15 +0200
From: Daniel Lezcano <daniel.lezcano@...aro.org>
To: Colin Ian King <colin.i.king@...il.com>,
 "Rafael J . Wysocki" <rafael@...nel.org>, Zhang Rui <rui.zhang@...el.com>,
 Lukasz Luba <lukasz.luba@....com>, Thierry Reding
 <thierry.reding@...il.com>, Jonathan Hunter <jonathanh@...dia.com>,
 linux-pm@...r.kernel.org, linux-tegra@...r.kernel.org
Cc: kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH][next] thermal: tegra: Fix dereference of pointer tz
 before it is null checked

On 30/07/2025 15:54, Colin Ian King wrote:
> Currently pointer tz is dereferenced before it is being null checked
> leading to a potential null pointer deferernce issue. Fix this by
> only defererencing it once it has been null checked.

Actually the callback should assume tz is never NULL because the caller 
does:

	ret = tz->ops.set_trip_temp(tz, trip, temp);

So removing the NULL pointer check is safe here.


> Fixes: 6fc2e1a5f98f ("thermal/drivers/tegra: Switch to new of API")
> 
> Signed-off-by: Colin Ian King <colin.i.king@...il.com>
> ---
>   drivers/thermal/tegra/soctherm.c | 13 +++++++++----
>   1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
> index 53a5c649f4b1..53fa6099b67f 100644
> --- a/drivers/thermal/tegra/soctherm.c
> +++ b/drivers/thermal/tegra/soctherm.c
> @@ -585,14 +585,19 @@ static int tsensor_group_thermtrip_get(struct tegra_soctherm *ts, int id)
>   static int tegra_thermctl_set_trip_temp(struct thermal_zone_device *tz,
>   					const struct thermal_trip *trip, int temp)
>   {
> -	struct tegra_thermctl_zone *zone = thermal_zone_device_priv(tz);
> -	struct tegra_soctherm *ts = zone->ts;
> -	const struct tegra_tsensor_group *sg = zone->sg;
> -	struct device *dev = zone->dev;
> +	struct tegra_thermctl_zone *zone;
> +	struct tegra_soctherm *ts;
> +	const struct tegra_tsensor_group *sg;
> +	struct device *dev;
>   
>   	if (!tz)
>   		return -EINVAL;
>   
> +	zone = thermal_zone_device_priv(tz);
> +	ts = zone->ts;
> +	sg = zone->sg;
> +	dev = zone->dev;
> +
>   	if (trip->type == THERMAL_TRIP_CRITICAL) {
>   		/*
>   		 * If thermtrips property is set in DT,


-- 
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog