[lkml]   [2020]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] thermal: Add a sanity check for invalid state at stats update
The thermal sysfs handler keeps the statistics table with the fixed
size that was determined from the initial max_states() call, and the
table entry is updated at each sysfs cur_state write call. And, when
the driver's set_cur_state() ops accepts the value given from
user-space, the thermal sysfs core blindly applies it to the
statistics table entry, which may overflow and cause an Oops.
Although it's rather a bug in the driver's ops implementations, we
shouldn't crash but rather give a proper warning instead.

This patch adds a sanity check for avoiding such an OOB access and
warns with a stack trace to show the suspicious device in question.

Signed-off-by: Takashi Iwai <>

We've hit some crash by stress tests, and this patch at least works
around the crash itself. While the actual bug fix of the buggy driver
is still being investigated, I submit the hardening in the core side
at first.

drivers/thermal/thermal_sysfs.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
index aa99edb4dff7..a23c4e701d63 100644
--- a/drivers/thermal/thermal_sysfs.c
+++ b/drivers/thermal/thermal_sysfs.c
@@ -772,6 +772,11 @@ void thermal_cooling_device_stats_update(struct thermal_cooling_device *cdev,


+ if (dev_WARN_ONCE(&cdev->device, new_state >= stats->max_states,
+ "new state %ld exceeds max_state %ld",
+ new_state, stats->max_states))
+ goto unlock;
if (stats->state == new_state)
goto unlock;

 \ /
  Last update: 2020-03-30 16:10    [W:0.062 / U:0.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site