From: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com>
To: djakov@kernel.org, amitk@kernel.org, thara.gopinath@gmail.com,
rafael@kernel.org, daniel.lezcano@kernel.org,
rui.zhang@intel.com, lukasz.luba@arm.com,
anjelique.melendez@oss.qualcomm.com,
konrad.dybcio@oss.qualcomm.com
Cc: linux-pm@vger.kernel.org, linux-arm-msm@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing
Date: Tue, 29 Sep 2026 08:50:24 +0200 [thread overview]
Message-ID: <99919a9b-a1ca-409d-babf-00d61177772f@oss.qualcomm.com> (raw)
In-Reply-To: <20260928132823.1426513-1-djakov@kernel.org>
On 9/28/26 15:28, djakov@kernel.org wrote:
> From: Georgi Djakov <djakov@kernel.org>
>
> Fix the following issue noticed when booting on the db845c-dragonboard:
>
> BUG: KASAN: global-out-of-bounds in qpnp_tm_sync_thresholds+0x11c/0x180 [qcom_spmi_temp_alarm]
> Read of size 24 at addr ffffdd2495f01200 by task (udev-worker)/371
>
> CPU: 3 UID: 0 PID: 371 Comm: (udev-worker) Not tainted 7.3.0-rc3 #116 PREEMPT
> Hardware name: Thundercomm Dragonboard 845c (DT)
> Call trace:
> show_stack+0x18/0x24 (C)
> dump_stack_lvl+0xa4/0xf4
> print_report+0x1f4/0x5ac
> kasan_report+0x84/0xcc
> kasan_check_range+0xf0/0x1a4
> memcpy+0x3c/0xa4
> qpnp_tm_sync_thresholds+0x11c/0x180 [qcom_spmi_temp_alarm]
> qpnp_tm_probe+0x3dc/0xae8 [qcom_spmi_temp_alarm]
> platform_probe+0xc4/0x18c
> really_probe+0x17c/0x4fc
> ...
>
> The buggy address belongs to the variable:
> temp_map_gen1+0x60/0xc4 [qcom_spmi_temp_alarm]
>
> It looks like temp_map is a pointer to the complete temperature map.
> Indexing it directly advances the entire map, rather than selecting a
> threshold row.
>
> Fix this by dereferencing the temp_map before indexing it to select the
> requested threshold row.
>
> Fixes: 703f13285a6c ("thermal/drivers/qcom-spmi-temp-alarm: Add temp alarm data struct based on HW subtype")
> Fixes: 1f835c6a4c84 ("thermal/drivers/qcom-spmi-temp-alarm: Prepare to support additional Temp Alarm subtypes")
> Signed-off-by: Georgi Djakov <djakov@kernel.org>
> ---
Applied, thanks
prev parent reply other threads:[~2026-09-29 6:50 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-28 13:28 djakov
2026-09-29 6:50 ` Daniel Lezcano [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=99919a9b-a1ca-409d-babf-00d61177772f@oss.qualcomm.com \
--to=daniel.lezcano@oss.qualcomm.com \
--cc=amitk@kernel.org \
--cc=anjelique.melendez@oss.qualcomm.com \
--cc=daniel.lezcano@kernel.org \
--cc=djakov@kernel.org \
--cc=konrad.dybcio@oss.qualcomm.com \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=lukasz.luba@arm.com \
--cc=rafael@kernel.org \
--cc=rui.zhang@intel.com \
--cc=thara.gopinath@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®