From patchwork Mon Jun 28 17:27:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Manivannan Sadhasivam X-Patchwork-Id: 468011 Delivered-To: patch@linaro.org Received: by 2002:a02:c94a:0:0:0:0:0 with SMTP id u10csp4180830jao; Mon, 28 Jun 2021 10:27:54 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx6NQhLsQp+sUopH/U+ywebob2GNjQ3Ax3tUbgERDiP58GSOkrWl+o6YtM+hOb/sbzuGa69 X-Received: by 2002:a05:6638:3fa:: with SMTP id s26mr666615jaq.16.1624901274174; Mon, 28 Jun 2021 10:27:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1624901274; cv=none; d=google.com; s=arc-20160816; b=MgqDH91EJojREkkogAq3zaTA4vn/dgnoycEQGF6u6tb6OBNRkslQMV2XwZxH4rsM0Z VEKM2CvU460Cjvsm9qoNEK/1vgKqiUIfkCwhoI6Vu1XEANe5bKK5CQ6YGiTDB1gpura6 veWjMYOyskHd+E2hR96ulZU4FpzgYL1k0HnYCqj1iJaXv6h3xaV2rh1TtGVm9c+5xYth iyQdSuMERBfqeC5MUpNipUIaixgG5w8rJwGkv7zk8Zokz6Kmplf5pKYla1Ug1I5uHJDq lNOrEhhcTxRJp3IJm9hM+oqgpag9+BVgRZk4vZpXK+eiQZBxkcauadpm1skuEUDhCe7V e/cA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=oi7s7ZAKggIYA9cELE+fXzXNfj41gs2Dc3uXc+ZK0C4=; b=qGU6MbVibhe8hYZe0xAfdaold3iDBLMep/bh7CNZPYK9e5ueVeRIHYLmlykj1hSw3z f+J0B/AG7SF0lKSYEiRjydIwqjlbRL0ZVUwJUnrWOGlnzI0qaNdOk4kAjTBPVYjjD9Yd Yw4rV7XlfHzOY0YyocP6FCtF7NKENxf5wkWDAkSOxrwgcuur1eiJdf3TVJsdb1YmNXbH 5sdT0rK0L7ta6msfU7mdO9dHGIAaCUAasu/BalyYc2o8oPENQe6Xs8H1dT+3SBLTybBr cRMeZsAmtscX93HTqpUVZkJiP7ci1qAKTDPRVfLu8MbYNeyHo+BMn+QchN4MPPAo0Dmm rWcQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=weXUs0nQ; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id w34si19108299jal.51.2021.06.28.10.27.53; Mon, 28 Jun 2021 10:27:54 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=weXUs0nQ; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233418AbhF1RaS (ORCPT + 12 others); Mon, 28 Jun 2021 13:30:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48298 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233057AbhF1RaS (ORCPT ); Mon, 28 Jun 2021 13:30:18 -0400 Received: from mail-pj1-x102a.google.com (mail-pj1-x102a.google.com [IPv6:2607:f8b0:4864:20::102a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 92459C061760 for ; Mon, 28 Jun 2021 10:27:52 -0700 (PDT) Received: by mail-pj1-x102a.google.com with SMTP id gd24-20020a17090b0fd8b02901702bcb0d90so6644051pjb.1 for ; Mon, 28 Jun 2021 10:27:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=oi7s7ZAKggIYA9cELE+fXzXNfj41gs2Dc3uXc+ZK0C4=; b=weXUs0nQHbJ7vo/3GvHUg0lzriDlghVSwf1RvxO+T7KI9n2a7VK/o0100WD1xlgdl0 +IfM5NkwkTUD2waBN/S1YVr4hAmBf00eWnMk/pyKcZZFi7HdbnssetKkcimwCXp9rWWF pli+y/mXUY+L6OxnuzvZXNk3Z8oMOIBed7TI5RidC8fdOf/FgFl+QjKCbP7Cx/kZKFfu sGoxaMbdCw8dqlbb7gEJOoaCvFl4dzXlK6XU9Yr+YOSxMTuZuWtfLej71QQJ/2JoLi9e eg8gSYnqzWywTq+hdbiw3UQBMyNroMQckc3ffjW2w3lAdWmiqDeF6eBVJiB8+EZT3wLA usHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=oi7s7ZAKggIYA9cELE+fXzXNfj41gs2Dc3uXc+ZK0C4=; b=ZomqeNOgisQ4XnBnBK7MNquBZsOgesbSkBUiT/PxMb0HFEZofVVkog42ZGdVRinlwc SWWiziiVJxI/K4G/DgzWrtCCUZh8/+dhHVZAgJSM7X2q6CmIvW0OKPO1o/vmwQkZoOzJ 2jM2hSWg9YKJ+fuTZIUB/s6CGPo9kGyIBrcwFuGGQzR56z/vF4tOaDfdjwBdqT/I8ZhM LhjwT1CkiOeefTj8+d66VnTID2nQLZaIkMmDeCM9YAbhD9c/xBrCIKCDImZPHOG/CZ6a IzlLNqCjsfeG04ixJYEgL6/0+oUtcE9RA5BK3KVs//trrEL3oksWq/9sHo47i8fbKo79 juVA== X-Gm-Message-State: AOAM533oSaI6EXmBwlH6Ah/FzcGjBMf2D7cM8DNpvmSKwWpjgKLgRj6r yfusL1G1hKbMHNu6YBkpVgcG X-Received: by 2002:a17:902:6b42:b029:11d:a147:bb7b with SMTP id g2-20020a1709026b42b029011da147bb7bmr24030953plt.9.1624901271951; Mon, 28 Jun 2021 10:27:51 -0700 (PDT) Received: from localhost.localdomain ([120.138.13.225]) by smtp.gmail.com with ESMTPSA id c24sm16482054pgj.11.2021.06.28.10.27.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Jun 2021 10:27:51 -0700 (PDT) From: Manivannan Sadhasivam To: bjorn.andersson@linaro.org Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, thara.gopinath@linaro.org, Manivannan Sadhasivam , stable@vger.kernel.org Subject: [PATCH] soc: qcom: aoss: Fix the out of bound usage of cooling_devs Date: Mon, 28 Jun 2021 22:57:41 +0530 Message-Id: <20210628172741.16894-1-manivannan.sadhasivam@linaro.org> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org In "qmp_cooling_devices_register", the count value is initially QMP_NUM_COOLING_RESOURCES, which is 2. Based on the initial count value, the memory for cooling_devs is allocated. Then while calling the "qmp_cooling_device_add" function, count value is post-incremented for each child node. This makes the out of bound access to the cooling_dev array. Fix it by resetting the count value to zero before adding cooling devices. While at it, let's also free the memory allocated to cooling_dev if no cooling device is found in DT and during unroll phase. Cc: stable@vger.kernel.org # 5.4 Fixes: 05589b30b21a ("soc: qcom: Extend AOSS QMP driver to support resources that are used to wake up the SoC.") Signed-off-by: Manivannan Sadhasivam --- Bjorn: I've just compile tested this patch. drivers/soc/qcom/qcom_aoss.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.25.1 diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c index 934fcc4d2b05..98c665411768 100644 --- a/drivers/soc/qcom/qcom_aoss.c +++ b/drivers/soc/qcom/qcom_aoss.c @@ -488,6 +488,7 @@ static int qmp_cooling_devices_register(struct qmp *qmp) if (!qmp->cooling_devs) return -ENOMEM; + count = 0; for_each_available_child_of_node(np, child) { if (!of_find_property(child, "#cooling-cells", NULL)) continue; @@ -497,12 +498,16 @@ static int qmp_cooling_devices_register(struct qmp *qmp) goto unroll; } + if (!count) + devm_kfree(qmp->dev, qmp->cooling_devs); + return 0; unroll: while (--count >= 0) thermal_cooling_device_unregister (qmp->cooling_devs[count].cdev); + devm_kfree(qmp->dev, qmp->cooling_devs); return ret; }