From 51c262cf2aa9dfd97591e570d4e82af493ad1689 Mon Sep 17 00:00:00 2001 From: Georgi Djakov Date: Mon, 28 Sep 2026 16:28:23 +0300 Subject: [PATCH] thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing Fix the following issue noticed when booting on the db845c-dragonboard: BUG: KASAN: global-out-of-bounds in qpnp_tm_sync_thresholds+0x11c/0x180 [qcom_spmi_temp_alarm] Read of size 24 at addr ffffdd2495f01200 by task (udev-worker)/371 CPU: 3 UID: 0 PID: 371 Comm: (udev-worker) Not tainted 7.3.0-rc3 #116 PREEMPT Hardware name: Thundercomm Dragonboard 845c (DT) Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0xa4/0xf4 print_report+0x1f4/0x5ac kasan_report+0x84/0xcc kasan_check_range+0xf0/0x1a4 memcpy+0x3c/0xa4 qpnp_tm_sync_thresholds+0x11c/0x180 [qcom_spmi_temp_alarm] qpnp_tm_probe+0x3dc/0xae8 [qcom_spmi_temp_alarm] platform_probe+0xc4/0x18c really_probe+0x17c/0x4fc ... The buggy address belongs to the variable: temp_map_gen1+0x60/0xc4 [qcom_spmi_temp_alarm] It looks like temp_map is a pointer to the complete temperature map. Indexing it directly advances the entire map, rather than selecting a threshold row. Fix this by dereferencing the temp_map before indexing it to select the requested threshold row. Fixes: 703f13285a6c ("thermal/drivers/qcom-spmi-temp-alarm: Add temp alarm data struct based on HW subtype") Fixes: 1f835c6a4c84 ("thermal/drivers/qcom-spmi-temp-alarm: Prepare to support additional Temp Alarm subtypes") Signed-off-by: Georgi Djakov Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20260928132823.1426513-1-djakov@kernel.org --- drivers/thermal/qcom/qcom-spmi-temp-alarm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c index fb003ca96454..911ebfd0cdeb 100644 --- a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c +++ b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c @@ -345,8 +345,8 @@ static int qpnp_tm_update_critical_trip_temp(struct qpnp_tm_chip *chip, } skip: - memcpy(chip->temp_thresh_map, chip->data->temp_map[threshold], - sizeof(chip->temp_thresh_map)); + memcpy(chip->temp_thresh_map, (*chip->data->temp_map)[threshold], + sizeof(chip->temp_thresh_map)); reg |= threshold; if (disable_stage2_shutdown && !chip->require_stage2_shutdown) reg |= SHUTDOWN_CTRL1_OVERRIDE_STAGE2; @@ -535,8 +535,8 @@ static int qpnp_tm_sync_thresholds(struct qpnp_tm_chip *chip) return ret; threshold = reg & SHUTDOWN_CTRL1_THRESHOLD_MASK; - memcpy(chip->temp_thresh_map, chip->data->temp_map[threshold], - sizeof(chip->temp_thresh_map)); + memcpy(chip->temp_thresh_map, (*chip->data->temp_map)[threshold], + sizeof(chip->temp_thresh_map)); return ret; }