Commit 7931e280 authored by Lee, Chun-Yi's avatar Lee, Chun-Yi Committed by Rafael J. Wysocki
Browse files

thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR 



In some case, the GDDV returns a package with a buffer which has
zero length. It causes that kmemdup() returns ZERO_SIZE_PTR (0x10).

Then the data_vault_read() got NULL point dereference problem when
accessing the 0x10 value in data_vault.

[   71.024560] BUG: kernel NULL pointer dereference, address:
0000000000000010

This patch uses ZERO_OR_NULL_PTR() for checking ZERO_SIZE_PTR or
NULL value in data_vault.

Signed-off-by: default avatar"Lee, Chun-Yi" <jlee@suse.com>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent 1c23f9e6

drivers/thermal/intel/int340x_thermal/int3400_thermal.c

+5 −4
Original line number Diff line number Diff line
@@ -527,7 +527,7 @@ static void int3400_setup_gddv(struct int3400_thermal_priv *priv) 
	priv->data_vault = kmemdup(obj->package.elements[0].buffer.pointer,

				   obj->package.elements[0].buffer.length,

				   GFP_KERNEL);

	if (!priv->data_vault)

	if (ZERO_OR_NULL_PTR(priv->data_vault))

		goto out_free;



	bin_attr_data_vault.private = priv->data_vault;
@@ -597,7 +597,7 @@ static int int3400_thermal_probe(struct platform_device *pdev) 
			goto free_imok;

	}



	if (priv->data_vault) {

	if (!ZERO_OR_NULL_PTR(priv->data_vault)) {

		result = sysfs_create_group(&pdev->dev.kobj,

					    &data_attribute_group);

		if (result)
@@ -615,6 +615,7 @@ static int int3400_thermal_probe(struct platform_device *pdev) 
free_sysfs:

	cleanup_odvp(priv);

	if (priv->data_vault) {

		if (!ZERO_OR_NULL_PTR(priv->data_vault))

			sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group);

		kfree(priv->data_vault);

	}
@@ -647,7 +648,7 @@ static int int3400_thermal_remove(struct platform_device *pdev) 
	if (!priv->rel_misc_dev_res)

		acpi_thermal_rel_misc_device_remove(priv->adev->handle);



	if (priv->data_vault)

	if (!ZERO_OR_NULL_PTR(priv->data_vault))

		sysfs_remove_group(&pdev->dev.kobj, &data_attribute_group);

	sysfs_remove_group(&pdev->dev.kobj, &uuid_attribute_group);

	sysfs_remove_group(&pdev->dev.kobj, &imok_attribute_group);