From fd8e44e0b48e1e7d2dad9a94d6496dbb59bee822 Mon Sep 17 00:00:00 2001 From: Wencai You Date: Thu, 23 May 2019 20:42:51 +0800 Subject: [PATCH] thermal: check array index when set cur_state [1/1] PD#SWPL-8747 Problem: android.security.sts.Poc17_11#testPocCVE_2017_6264 test echo /sys/devices/virtual/thermal/cooling_device2/cur_state crash Solution: check array index Verify: verified by u212 Change-Id: I235d62508d95fffaed7b811ba008384db7c7ec6f Signed-off-by: Wencai You --- drivers/amlogic/thermal/gpu_cooling.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/amlogic/thermal/gpu_cooling.c b/drivers/amlogic/thermal/gpu_cooling.c index 6d9fe358fc20..04f31157d0dd 100644 --- a/drivers/amlogic/thermal/gpu_cooling.c +++ b/drivers/amlogic/thermal/gpu_cooling.c @@ -151,8 +151,10 @@ static int gpufreq_set_cur_state(struct thermal_cooling_device *cdev, state, gpufreq_device->gpufreq_state); /* if (gpufreq_device->gpufreq_state == state) */ /* return 0; */ - gpufreq_device->gpufreq_state = state; ret = gpufreq_get_max_state(cdev, &max_state); + if (state > max_state-1) + state = max_state-1; + gpufreq_device->gpufreq_state = state; state = max_state-1-state; pr_debug("state=%ld,gpufreq_device->gpufreq_state=%d\n",