potential NULL dereference at get_target_state in drivers/thermal/fair_share.c

potential NULL dereference at get_target_state in drivers/thermal/fair_share.c

[devendra.aaru]

Hello Zhang, Durgadoss,

I have found a code that does this cdev->ops->get_max_state

static long get_target_state(struct thermal_zone_device *tz,
                struct thermal_cooling_device *cdev, int weight, int level)
{
        unsigned long max_state;

        cdev->ops->get_max_state(cdev, &max_state);

        return (long)(weight * level * max_state) / (100 * tz->trips);
}

as the ops can be NULL the panic can occur. if not i have to check for
a valid get_max_state pointer. so if the ops->get_max_state is NULL
what should i suppose to be returning here?

thanks a lot,

Re: potential NULL dereference at get_target_state in drivers/thermal/fair_share.c

[Zhang Rui]

On Sat, 2013-03-30 at 15:35 +0530, devendra.aaru wrote:
> Hello Zhang, Durgadoss,
> 
> I have found a code that does this cdev->ops->get_max_state
> 
> static long get_target_state(struct thermal_zone_device *tz,
>                 struct thermal_cooling_device *cdev, int weight, int level)
> {
>         unsigned long max_state;
> 
>         cdev->ops->get_max_state(cdev, &max_state);
> 
>         return (long)(weight * level * max_state) / (100 * tz->trips);
> }
> 
> as the ops can be NULL the panic can occur. if not i have to check for
> a valid get_max_state pointer. so if the ops->get_max_state is NULL
> what should i suppose to be returning here?
> 
any cdev must be registered with valid ops and ops->get_max_state.
if ops or ops->get_max_state is NULL, it suggests a big problem, like
racing issue, etc, and IMO, a panic is more meaningful for us to debug
the problem here.

thanks,
rui