thermal: Validate new state in cur_state_store()

[ Upstream commit c408b3d1d9bbc7de5fb0304fea424ef2539da616 ]

In cur_state_store(), the new state of the cooling device is received
from user-space and is not validated by the thermal core but the same is
left for the individual drivers to take care of. Apart from duplicating
the code it leaves possibility for introducing bugs where a driver may
not do it right.

Lets make the thermal core check the new state itself and store the max
value in the cooling device structure.

Link: https://lore.kernel.org/all/Y0ltRJRjO7AkawvE@kili/
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 6c54b7bc8a31 ("thermal: core: call put_device() only after device_register() fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/thermal/gov_fair_share.c b/drivers/thermal/gov_fair_share.c
index 6a2abcfc648f7f9b08464603ff89a2afa704a09c..a4c30797b5343ed5e6be7afaede61b01a4faee73 100644 (file)
--- a/drivers/thermal/gov_fair_share.c
+++ b/drivers/thermal/gov_fair_share.c
@@ -49,11 +49,7 @@ static int get_trip_level(struct thermal_zone_device *tz)
 static long get_target_state(struct thermal_zone_device *tz,
                struct thermal_cooling_device *cdev, int percentage, int level)
 {
-       unsigned long max_state;
-
-       cdev->ops->get_max_state(cdev, &max_state);
-
-       return (long)(percentage * level * max_state) / (100 * tz->num_trips);
+       return (long)(percentage * level * cdev->max_state) / (100 * tz->num_trips);
 }
 
 /**

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index c6b7eaffceda276d6cb180c5ee68ee4419a662c7..96d6082864ee9e12304cac48e1a585fb68447510 100644 (file)
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -625,8 +625,7 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
        struct thermal_instance *pos;
        struct thermal_zone_device *pos1;
        struct thermal_cooling_device *pos2;
-       unsigned long max_state;
-       int result, ret;
+       int result;
 
        if (trip >= tz->num_trips || trip < 0)
                return -EINVAL;
@@ -643,15 +642,11 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
        if (tz != pos1 || cdev != pos2)
                return -EINVAL;
 
-       ret = cdev->ops->get_max_state(cdev, &max_state);
-       if (ret)
-               return ret;
-
        /* lower default 0, upper default max_state */
        lower = lower == THERMAL_NO_LIMIT ? 0 : lower;
-       upper = upper == THERMAL_NO_LIMIT ? max_state : upper;
+       upper = upper == THERMAL_NO_LIMIT ? cdev->max_state : upper;
 
-       if (lower > upper || upper > max_state)
+       if (lower > upper || upper > cdev->max_state)
                return -EINVAL;
 
        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
@@ -918,6 +913,10 @@ __thermal_cooling_device_register(struct device_node *np,
        cdev->updated = false;
        cdev->device.class = &thermal_class;
        cdev->devdata = devdata;
+
+       if (cdev->ops->get_max_state(cdev, &cdev->max_state))
+               goto out_kfree_type;
+
        thermal_cooling_device_setup_sysfs(cdev);
        ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
        if (ret) {

diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c
index 3a8d6e747c255dd639100762b2f8c5ecdcd3650b..de7cdec3db909cc655b4b9ac66b9b05a45c4fc36 100644 (file)
--- a/drivers/thermal/thermal_sysfs.c
+++ b/drivers/thermal/thermal_sysfs.c
@@ -580,13 +580,8 @@ static ssize_t max_state_show(struct device *dev, struct device_attribute *attr,
                              char *buf)
 {
        struct thermal_cooling_device *cdev = to_cooling_device(dev);
-       unsigned long state;
-       int ret;
 
-       ret = cdev->ops->get_max_state(cdev, &state);
-       if (ret)
-               return ret;
-       return sprintf(buf, "%ld\n", state);
+       return sprintf(buf, "%ld\n", cdev->max_state);
 }
 
 static ssize_t cur_state_show(struct device *dev, struct device_attribute *attr,
@@ -616,6 +611,10 @@ cur_state_store(struct device *dev, struct device_attribute *attr,
        if ((long)state < 0)
                return -EINVAL;
 
+       /* Requested state should be less than max_state + 1 */
+       if (state > cdev->max_state)
+               return -EINVAL;
+
        mutex_lock(&cdev->lock);
 
        result = cdev->ops->set_cur_state(cdev, state);

diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index 67f12191402053a5021de37656d1a694cdaa70f4..b94314ed0c965cb0da22c97bf1acf990acc3f780 100644 (file)
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -92,6 +92,7 @@ struct thermal_cooling_device_ops {
 struct thermal_cooling_device {
        int id;
        char *type;
+       unsigned long max_state;
        struct device device;
        struct device_node *np;
        void *devdata;