From b17d799ce49bfaad68be5ff3df995b3bd021a9d7 Mon Sep 17 00:00:00 2001 From: Weigang He Date: Sat, 26 Sep 2026 14:27:57 +1000 Subject: [PATCH] thermal/drivers/sprd: validate the sensor id from the device tree sprd_thm_probe() reads each sensor child node's "reg" property into sen->id and uses it without validation: to compute the sensor's register offsets in sprd_thm_sensor_init(), as the thermal zone id, and finally as an index into thm->sensor[], which has SPRD_THM_MAX_SENSOR (8) entries: ret = of_property_read_u32(sen_child, "reg", &sen->id); ... thm->sensor[sen->id] = sen; Only the number of sensor nodes is checked against SPRD_THM_MAX_SENSOR. A "reg" value of 8 or more, or one that is negative once stored in the int sen->id, makes the register offsets point outside the sensor range and the final store land outside thm->sensor[], overwriting the fields that follow it in struct sprd_thermal_data or other memory. Reject an out-of-range id right after reading it, before it is used. This does not address sparse ids, such as a single sensor with id 7: they leave holes in thm->sensor[] that the later loops over 0..nr_sensors-1 dereference. That needs a separate fix. Found by static analysis tool CodeQL. Fixes: 554fdbaf19b1 ("thermal: sprd: Add Spreadtrum thermal driver support") Assisted-by: LLM codeql Signed-off-by: Weigang He Signed-off-by: Daniel Lezcano Link: https://patch.msgid.link/20260926042757.2109927-1-geoffreyhe2@gmail.com --- drivers/thermal/sprd_thermal.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/thermal/sprd_thermal.c b/drivers/thermal/sprd_thermal.c index d683fcb0f8ab..b57277e2eac0 100644 --- a/drivers/thermal/sprd_thermal.c +++ b/drivers/thermal/sprd_thermal.c @@ -396,6 +396,12 @@ static int sprd_thm_probe(struct platform_device *pdev) goto of_put; } + if (sen->id < 0 || sen->id >= SPRD_THM_MAX_SENSOR) { + dev_err(&pdev->dev, "invalid sensor id %d\n", sen->id); + ret = -EINVAL; + goto of_put; + } + ret = sprd_thm_sensor_calibration(sen_child, thm, sen); if (ret) { dev_err(&pdev->dev, "efuse cal analysis failed");