Commit c408b3d1 authored by Viresh Kumar's avatar Viresh Kumar Committed by Rafael J. Wysocki

thermal: Validate new state in cur_state_store()

In cur_state_store(), the new state of the cooling device is received
from user-space and is not validated by the thermal core but the same is
left for the individual drivers to take care of. Apart from duplicating
the code it leaves possibility for introducing bugs where a driver may
not do it right.

Lets make the thermal core check the new state itself and store the max
value in the cooling device structure.

Link: https://lore.kernel.org/all/Y0ltRJRjO7AkawvE@kili/Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent 247f34f7
...@@ -49,11 +49,7 @@ static int get_trip_level(struct thermal_zone_device *tz) ...@@ -49,11 +49,7 @@ static int get_trip_level(struct thermal_zone_device *tz)
static long get_target_state(struct thermal_zone_device *tz, static long get_target_state(struct thermal_zone_device *tz,
struct thermal_cooling_device *cdev, int percentage, int level) struct thermal_cooling_device *cdev, int percentage, int level)
{ {
unsigned long max_state; return (long)(percentage * level * cdev->max_state) / (100 * tz->num_trips);
cdev->ops->get_max_state(cdev, &max_state);
return (long)(percentage * level * max_state) / (100 * tz->num_trips);
} }
/** /**
......
...@@ -603,8 +603,7 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz, ...@@ -603,8 +603,7 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
struct thermal_instance *pos; struct thermal_instance *pos;
struct thermal_zone_device *pos1; struct thermal_zone_device *pos1;
struct thermal_cooling_device *pos2; struct thermal_cooling_device *pos2;
unsigned long max_state; int result;
int result, ret;
if (trip >= tz->num_trips || trip < 0) if (trip >= tz->num_trips || trip < 0)
return -EINVAL; return -EINVAL;
...@@ -621,15 +620,11 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz, ...@@ -621,15 +620,11 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
if (tz != pos1 || cdev != pos2) if (tz != pos1 || cdev != pos2)
return -EINVAL; return -EINVAL;
ret = cdev->ops->get_max_state(cdev, &max_state);
if (ret)
return ret;
/* lower default 0, upper default max_state */ /* lower default 0, upper default max_state */
lower = lower == THERMAL_NO_LIMIT ? 0 : lower; lower = lower == THERMAL_NO_LIMIT ? 0 : lower;
upper = upper == THERMAL_NO_LIMIT ? max_state : upper; upper = upper == THERMAL_NO_LIMIT ? cdev->max_state : upper;
if (lower > upper || upper > max_state) if (lower > upper || upper > cdev->max_state)
return -EINVAL; return -EINVAL;
dev = kzalloc(sizeof(*dev), GFP_KERNEL); dev = kzalloc(sizeof(*dev), GFP_KERNEL);
...@@ -900,6 +895,10 @@ __thermal_cooling_device_register(struct device_node *np, ...@@ -900,6 +895,10 @@ __thermal_cooling_device_register(struct device_node *np,
cdev->updated = false; cdev->updated = false;
cdev->device.class = &thermal_class; cdev->device.class = &thermal_class;
cdev->devdata = devdata; cdev->devdata = devdata;
if (cdev->ops->get_max_state(cdev, &cdev->max_state))
goto out_kfree_type;
thermal_cooling_device_setup_sysfs(cdev); thermal_cooling_device_setup_sysfs(cdev);
ret = device_register(&cdev->device); ret = device_register(&cdev->device);
if (ret) if (ret)
......
...@@ -589,13 +589,8 @@ static ssize_t max_state_show(struct device *dev, struct device_attribute *attr, ...@@ -589,13 +589,8 @@ static ssize_t max_state_show(struct device *dev, struct device_attribute *attr,
char *buf) char *buf)
{ {
struct thermal_cooling_device *cdev = to_cooling_device(dev); struct thermal_cooling_device *cdev = to_cooling_device(dev);
unsigned long state;
int ret;
ret = cdev->ops->get_max_state(cdev, &state); return sprintf(buf, "%ld\n", cdev->max_state);
if (ret)
return ret;
return sprintf(buf, "%ld\n", state);
} }
static ssize_t cur_state_show(struct device *dev, struct device_attribute *attr, static ssize_t cur_state_show(struct device *dev, struct device_attribute *attr,
...@@ -625,6 +620,10 @@ cur_state_store(struct device *dev, struct device_attribute *attr, ...@@ -625,6 +620,10 @@ cur_state_store(struct device *dev, struct device_attribute *attr,
if ((long)state < 0) if ((long)state < 0)
return -EINVAL; return -EINVAL;
/* Requested state should be less than max_state + 1 */
if (state > cdev->max_state)
return -EINVAL;
mutex_lock(&cdev->lock); mutex_lock(&cdev->lock);
result = cdev->ops->set_cur_state(cdev, state); result = cdev->ops->set_cur_state(cdev, state);
......
...@@ -100,6 +100,7 @@ struct thermal_cooling_device_ops { ...@@ -100,6 +100,7 @@ struct thermal_cooling_device_ops {
struct thermal_cooling_device { struct thermal_cooling_device {
int id; int id;
char *type; char *type;
unsigned long max_state;
struct device device; struct device device;
struct device_node *np; struct device_node *np;
void *devdata; void *devdata;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment