From ef3e98b0aa4b348f44065d7130251273c83bd204 Mon Sep 17 00:00:00 2001 From: Samuel Moelius Date: Fri, 5 Jun 2026 18:52:06 +0000 Subject: [PATCH 1/3] thermal: testing: reject missing command arguments The thermal testing debugfs command parser splits commands at ':' and passes the right-hand side to the command implementation. Commands such as deltz, tzaddtrip, tzreg, and tzunreg require a zone id, but writing one of those command names without ':' leaves the argument pointer NULL. The command implementations parse the id with sscanf(arg, "%d", ...), so the missing-argument form dereferences a NULL pointer from the debugfs write path. Reject missing arguments in tt_command_exec() before calling handlers that require an id. Fixes: f6a034f2df42 ("thermal: Introduce a debugfs-based testing facility") Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius Link: https://patch.msgid.link/20260605185212.2491144-1-sam.moelius@trailofbits.com Signed-off-by: Rafael J. Wysocki --- drivers/thermal/testing/command.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/thermal/testing/command.c b/drivers/thermal/testing/command.c index 1159ecea57e7..fbf7ab9729b5 100644 --- a/drivers/thermal/testing/command.c +++ b/drivers/thermal/testing/command.c @@ -116,18 +116,30 @@ static int tt_command_exec(int index, const char *arg) break; case TT_CMD_DELTZ: + if (!arg || !*arg) + return -EINVAL; + ret = tt_del_tz(arg); break; case TT_CMD_TZADDTRIP: + if (!arg || !*arg) + return -EINVAL; + ret = tt_zone_add_trip(arg); break; case TT_CMD_TZREG: + if (!arg || !*arg) + return -EINVAL; + ret = tt_zone_reg(arg); break; case TT_CMD_TZUNREG: + if (!arg || !*arg) + return -EINVAL; + ret = tt_zone_unreg(arg); break; From e4f87cfcbae03498f0fd1689653cf84126196e14 Mon Sep 17 00:00:00 2001 From: Ovidiu Panait Date: Sun, 7 Jun 2026 00:04:19 +0300 Subject: [PATCH 2/3] thermal: testing: Replace sscanf() with kstrtoint() Generally, kstrtoint() is preferred to sscanf() in kernel code, so replace the latter with the former in tt_del_tz() and tt_get_tt_zone(). Signed-off-by: Ovidiu Panait [ rjw: Changelog rewrite ] Link: https://patch.msgid.link/20260606210420.2311145-2-ovidiu.panait.oss@gmail.com Signed-off-by: Rafael J. Wysocki --- drivers/thermal/testing/zone.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/thermal/testing/zone.c b/drivers/thermal/testing/zone.c index 3c339242f52d..f7f9ca2f1f2c 100644 --- a/drivers/thermal/testing/zone.c +++ b/drivers/thermal/testing/zone.c @@ -239,9 +239,9 @@ int tt_del_tz(const char *arg) int ret; int id; - ret = sscanf(arg, "%d", &id); - if (ret != 1) - return -EINVAL; + ret = kstrtoint(arg, 10, &id); + if (ret < 0) + return ret; struct tt_work *tt_work __free(kfree) = kzalloc_obj(*tt_work); if (!tt_work) @@ -279,9 +279,9 @@ static struct tt_thermal_zone *tt_get_tt_zone(const char *arg) struct tt_thermal_zone *tt_zone; int ret, id; - ret = sscanf(arg, "%d", &id); - if (ret != 1) - return ERR_PTR(-EINVAL); + ret = kstrtoint(arg, 10, &id); + if (ret < 0) + return ERR_PTR(ret); guard(mutex)(&tt_thermal_zones_lock); From 64762d48ec84d36fc2618920a731368387253efc Mon Sep 17 00:00:00 2001 From: Ovidiu Panait Date: Sun, 7 Jun 2026 00:04:20 +0300 Subject: [PATCH 3/3] thermal: sysfs: Replace sscanf() with kstrtoul() Replace sscanf() with kstrtoul() in cur_state_store(), as kstrto is preferred over single-variable sscanf(). Signed-off-by: Ovidiu Panait [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260606210420.2311145-3-ovidiu.panait.oss@gmail.com Signed-off-by: Rafael J. Wysocki --- drivers/thermal/thermal_sysfs.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c index 9f2f25a6da37..b44abfc997ed 100644 --- a/drivers/thermal/thermal_sysfs.c +++ b/drivers/thermal/thermal_sysfs.c @@ -536,11 +536,9 @@ cur_state_store(struct device *dev, struct device_attribute *attr, unsigned long state; int result; - if (sscanf(buf, "%ld\n", &state) != 1) - return -EINVAL; - - if ((long)state < 0) - return -EINVAL; + result = kstrtoul(buf, 10, &state); + if (result < 0) + return result; /* Requested state should be less than max_state + 1 */ if (state > cdev->max_state)