diff options
| author | Georgi Djakov <djakov@kernel.org> | 2026-09-28 16:28:23 +0300 |
|---|---|---|
| committer | Daniel Lezcano <daniel.lezcano@kernel.org> | 2026-10-13 16:26:37 +0200 |
| commit | 51c262cf2aa9dfd97591e570d4e82af493ad1689 (patch) | |
| tree | 307e1435b14ce2c4f8e9079fe5240bb521bb5dce /drivers | |
| parent | 481860eba83b3fe27ca9be6f7f5bb4c8febc6572 (diff) | |
| download | linux-next-51c262cf2aa9dfd97591e570d4e82af493ad1689.tar.gz linux-next-51c262cf2aa9dfd97591e570d4e82af493ad1689.zip | |
thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing
Fix the following issue noticed when booting on the db845c-dragonboard:
BUG: KASAN: global-out-of-bounds in qpnp_tm_sync_thresholds+0x11c/0x180 [qcom_spmi_temp_alarm]
Read of size 24 at addr ffffdd2495f01200 by task (udev-worker)/371
CPU: 3 UID: 0 PID: 371 Comm: (udev-worker) Not tainted 7.3.0-rc3 #116 PREEMPT
Hardware name: Thundercomm Dragonboard 845c (DT)
Call trace:
show_stack+0x18/0x24 (C)
dump_stack_lvl+0xa4/0xf4
print_report+0x1f4/0x5ac
kasan_report+0x84/0xcc
kasan_check_range+0xf0/0x1a4
memcpy+0x3c/0xa4
qpnp_tm_sync_thresholds+0x11c/0x180 [qcom_spmi_temp_alarm]
qpnp_tm_probe+0x3dc/0xae8 [qcom_spmi_temp_alarm]
platform_probe+0xc4/0x18c
really_probe+0x17c/0x4fc
...
The buggy address belongs to the variable:
temp_map_gen1+0x60/0xc4 [qcom_spmi_temp_alarm]
It looks like temp_map is a pointer to the complete temperature map.
Indexing it directly advances the entire map, rather than selecting a
threshold row.
Fix this by dereferencing the temp_map before indexing it to select the
requested threshold row.
Fixes: 703f13285a6c ("thermal/drivers/qcom-spmi-temp-alarm: Add temp alarm data struct based on HW subtype")
Fixes: 1f835c6a4c84 ("thermal/drivers/qcom-spmi-temp-alarm: Prepare to support additional Temp Alarm subtypes")
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260928132823.1426513-1-djakov@kernel.org
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c index fb003ca96454..911ebfd0cdeb 100644 --- a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c +++ b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c @@ -345,8 +345,8 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, } skip: - memcpy(chip->temp_thresh_map, chip->data->temp_map[threshold], - sizeof(chip->temp_thresh_map)); + memcpy(chip->temp_thresh_map, (*chip->data->temp_map)[threshold], + sizeof(chip->temp_thresh_map)); reg |= threshold; if (disable_stage2_shutdown && !chip->require_stage2_shutdown) reg |= SHUTDOWN_CTRL1_OVERRIDE_STAGE2; @@ -535,8 +535,8 @@ static int qpnp_tm_sync_thresholds(struct qpnp_tm_chip *chip) return ret; threshold = reg & SHUTDOWN_CTRL1_THRESHOLD_MASK; - memcpy(chip->temp_thresh_map, chip->data->temp_map[threshold], - sizeof(chip->temp_thresh_map)); + memcpy(chip->temp_thresh_map, (*chip->data->temp_map)[threshold], + sizeof(chip->temp_thresh_map)); return ret; } |