[PATCH] thermal: testing: reject missing command arguments

[PATCH] thermal: testing: reject missing command arguments

[Samuel Moelius]

The thermal testing debugfs command parser splits commands at ':' and
passes the right-hand side to the command implementation. Commands such
as deltz, tzaddtrip, tzreg, and tzunreg require a zone id, but writing
one of those command names without ':' leaves the argument pointer NULL.

The command implementations parse the id with sscanf(arg, "%d", ...), so
the missing-argument form dereferences a NULL pointer from the debugfs
write path.

Reject missing arguments in tt_command_exec() before calling handlers
that require an id.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
---
 drivers/thermal/testing/command.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/thermal/testing/command.c b/drivers/thermal/testing/command.c
index 1159ecea57e7..fbf7ab9729b5 100644
--- a/drivers/thermal/testing/command.c
+++ b/drivers/thermal/testing/command.c
@@ -116,18 +116,30 @@ static int tt_command_exec(int index, const char *arg)
 		break;
 
 	case TT_CMD_DELTZ:
+		if (!arg || !*arg)
+			return -EINVAL;
+
 		ret = tt_del_tz(arg);
 		break;
 
 	case TT_CMD_TZADDTRIP:
+		if (!arg || !*arg)
+			return -EINVAL;
+
 		ret = tt_zone_add_trip(arg);
 		break;
 
 	case TT_CMD_TZREG:
+		if (!arg || !*arg)
+			return -EINVAL;
+
 		ret = tt_zone_reg(arg);
 		break;
 
 	case TT_CMD_TZUNREG:
+		if (!arg || !*arg)
+			return -EINVAL;
+
 		ret = tt_zone_unreg(arg);
 		break;
 
-- 
2.43.0

Re: [PATCH] thermal: testing: reject missing command arguments

[Rafael J. Wysocki]

On Fri, Jun 5, 2026 at 8:52 PM Samuel Moelius
<sam.moelius@trailofbits.com> wrote:
>
> The thermal testing debugfs command parser splits commands at ':' and
> passes the right-hand side to the command implementation. Commands such
> as deltz, tzaddtrip, tzreg, and tzunreg require a zone id, but writing
> one of those command names without ':' leaves the argument pointer NULL.
>
> The command implementations parse the id with sscanf(arg, "%d", ...), so
> the missing-argument form dereferences a NULL pointer from the debugfs
> write path.
>
> Reject missing arguments in tt_command_exec() before calling handlers
> that require an id.
>
> Assisted-by: Codex:gpt-5.5-cyber-preview
> Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
> ---
>  drivers/thermal/testing/command.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/drivers/thermal/testing/command.c b/drivers/thermal/testing/command.c
> index 1159ecea57e7..fbf7ab9729b5 100644
> --- a/drivers/thermal/testing/command.c
> +++ b/drivers/thermal/testing/command.c
> @@ -116,18 +116,30 @@ static int tt_command_exec(int index, const char *arg)
>                 break;
>
>         case TT_CMD_DELTZ:
> +               if (!arg || !*arg)
> +                       return -EINVAL;
> +
>                 ret = tt_del_tz(arg);
>                 break;
>
>         case TT_CMD_TZADDTRIP:
> +               if (!arg || !*arg)
> +                       return -EINVAL;
> +
>                 ret = tt_zone_add_trip(arg);
>                 break;
>
>         case TT_CMD_TZREG:
> +               if (!arg || !*arg)
> +                       return -EINVAL;
> +
>                 ret = tt_zone_reg(arg);
>                 break;
>
>         case TT_CMD_TZUNREG:
> +               if (!arg || !*arg)
> +                       return -EINVAL;
> +
>                 ret = tt_zone_unreg(arg);
>                 break;
>
> --

Applied as 7.2 material, thanks!