Commit 05a687d1 authored by Lee, Chun-Yi's avatar Lee, Chun-Yi Committed by Pu Lehui
Browse files

thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR 

mainline inclusion
from mainline-v6.0-rc3
commit 7931e280
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9LKDZ
CVE: CVE-2022-48703

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7931e28098a4



--------------------------------

In some case, the GDDV returns a package with a buffer which has
zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10).

Then the data_vault_read() got NULL point dereference problem when
accessing the 0x10 value in data_vault.

[   71.024560] BUG: kernel NULL pointer dereference, address:
0000000000000010

This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or
NULL value in data_vault.

Signed-off-by: default avatar"Lee, Chun-Yi" <jlee@suse.com>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
Conflicts:
	drivers/thermal/intel/int340x_thermal/int3400_thermal.c
[The conflicts were caused by not merged 9e5d3d6b ("thermal:
int340x: Consolidate freeing of acpi_buffer pointer")]
Signed-off-by: default avatarPu Lehui <pulehui@huawei.com>
parent d0d5bb1b

drivers/thermal/intel/int340x_thermal/int3400_thermal.c

+5 −4
Original line number Diff line number Diff line
@@ -466,7 +466,7 @@ static void int3400_setup_gddv(struct int3400_thermal_priv *priv) 
	priv->data_vault = kmemdup(obj->package.elements[0].buffer.pointer,

				   obj->package.elements[0].buffer.length,

				   GFP_KERNEL);

	if (!priv->data_vault) {

	if (ZERO_OR_NULL_PTR(priv->data_vault)) {

		kfree(buffer.pointer);

		return;

	}
@@ -531,7 +531,7 @@ static int int3400_thermal_probe(struct platform_device *pdev) 
	if (result)

		goto free_rel_misc;



	if (priv->data_vault) {

	if (!ZERO_OR_NULL_PTR(priv->data_vault)) {

		result = sysfs_create_group(&pdev->dev.kobj,

					    &data_attribute_group);

		if (result)
@@ -549,6 +549,7 @@ static int int3400_thermal_probe(struct platform_device *pdev) 
free_sysfs:

	cleanup_odvp(priv);

	if (priv->data_vault) {

		if (!ZERO_OR_NULL_PTR(priv->data_vault))

			sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group);

		kfree(priv->data_vault);

	}
@@ -579,7 +580,7 @@ static int int3400_thermal_remove(struct platform_device *pdev) 
	if (!priv->rel_misc_dev_res)

		acpi_thermal_rel_misc_device_remove(priv->adev->handle);



	if (priv->data_vault)

	if (!ZERO_OR_NULL_PTR(priv->data_vault))

		sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group);

	sysfs_remove_group(&pdev->dev.kobj, &uuid_attribute_group);

	thermal_zone_device_unregister(priv->thermal);