On 30/07/2025 15:54, Colin Ian King wrote:
Currently pointer tz is dereferenced before it is being null checked
leading to a potential null pointer deferernce issue. Fix this by
only defererencing it once it has been null checked.
Actually the callback should assume tz is never NULL because the caller
does:
ret = tz->ops.set_trip_temp(tz, trip, temp);
So removing the NULL pointer check is safe here.
Fixes: 6fc2e1a5f98f ("thermal/drivers/tegra: Switch to new of API")
Signed-off-by: Colin Ian King <colin.i.king@xxxxxxxxx>
---
drivers/thermal/tegra/soctherm.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/thermal/tegra/soctherm.c b/drivers/thermal/tegra/soctherm.c
index 53a5c649f4b1..53fa6099b67f 100644
--- a/drivers/thermal/tegra/soctherm.c
+++ b/drivers/thermal/tegra/soctherm.c
@@ -585,14 +585,19 @@ static int tsensor_group_thermtrip_get(struct tegra_soctherm *ts, int id)
static int tegra_thermctl_set_trip_temp(struct thermal_zone_device *tz,
const struct thermal_trip *trip, int temp)
{
- struct tegra_thermctl_zone *zone = thermal_zone_device_priv(tz);
- struct tegra_soctherm *ts = zone->ts;
- const struct tegra_tsensor_group *sg = zone->sg;
- struct device *dev = zone->dev;
+ struct tegra_thermctl_zone *zone;
+ struct tegra_soctherm *ts;
+ const struct tegra_tsensor_group *sg;
+ struct device *dev;
if (!tz)
return -EINVAL;
+ zone = thermal_zone_device_priv(tz);
+ ts = zone->ts;
+ sg = zone->sg;
+ dev = zone->dev;
+
if (trip->type == THERMAL_TRIP_CRITICAL) {
/*
* If thermtrips property is set in DT,
--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs
Follow Linaro: <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog
