releases/4.14.113/thermal-bcm2835-fix-crash-in-bcm2835_thermal_debugfs.patch

   1 From f64217c1467cb3d2935899d9ff55cd4486917943 Mon Sep 17 00:00:00 2001
   2 From: Phil Elwell <phil@raspberrypi.org>
   3 Date: Tue, 29 Jan 2019 09:55:57 +0000
   4 Subject: thermal: bcm2835: Fix crash in bcm2835_thermal_debugfs
   5
   6 [ Upstream commit 35122495a8c6683e863acf7b05a7036b2be64c7a ]
   7
   8 "cat /sys/kernel/debug/bcm2835_thermal/regset" causes a NULL pointer
   9 dereference in bcm2835_thermal_debugfs. The driver makes use of the
  10 implementation details of the thermal framework to retrieve a pointer
  11 to its private data from a struct thermal_zone_device, and gets it
  12 wrong - leading to the crash. Instead, store its private data as the
  13 drvdata and retrieve the thermal_zone_device pointer from it.
  14
  15 Fixes: bcb7dd9ef206 ("thermal: bcm2835: add thermal driver for bcm2835 SoC")
  16
  17 Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  18 Signed-off-by: Zhang Rui <rui.zhang@intel.com>
  19 Signed-off-by: Sasha Levin <sashal@kernel.org>
  20 ---
  21  drivers/thermal/broadcom/bcm2835_thermal.c | 9 ++++-----
  22  1 file changed, 4 insertions(+), 5 deletions(-)
  23
  24 diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c
  25 index 24b006a95142..8646fb7425f2 100644
  26 --- a/drivers/thermal/broadcom/bcm2835_thermal.c
  27 +++ b/drivers/thermal/broadcom/bcm2835_thermal.c
  28 @@ -128,8 +128,7 @@ static const struct debugfs_reg32 bcm2835_thermal_regs[] = {
  29
  30  static void bcm2835_thermal_debugfs(struct platform_device *pdev)
  31  {
  32 -       struct thermal_zone_device *tz = platform_get_drvdata(pdev);
  33 -       struct bcm2835_thermal_data *data = tz->devdata;
  34 +       struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
  35         struct debugfs_regset32 *regset;
  36
  37         data->debugfsdir = debugfs_create_dir("bcm2835_thermal", NULL);
  38 @@ -275,7 +274,7 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
  39
  40         data->tz = tz;
  41
  42 -       platform_set_drvdata(pdev, tz);
  43 +       platform_set_drvdata(pdev, data);
  44
  45         /*
  46          * Thermal_zone doesn't enable hwmon as default,
  47 @@ -299,8 +298,8 @@ static int bcm2835_thermal_probe(struct platform_device *pdev)
  48
  49  static int bcm2835_thermal_remove(struct platform_device *pdev)
  50  {
  51 -       struct thermal_zone_device *tz = platform_get_drvdata(pdev);
  52 -       struct bcm2835_thermal_data *data = tz->devdata;
  53 +       struct bcm2835_thermal_data *data = platform_get_drvdata(pdev);
  54 +       struct thermal_zone_device *tz = data->tz;
  55
  56         debugfs_remove_recursive(data->debugfsdir);
  57         thermal_zone_of_sensor_unregister(&pdev->dev, tz);
  58 --
  59 2.19.1
  60