Re: [PATCH] thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing
From: Daniel Lezcano
Date: Tue Sep 29 2026 - 02:50:39 EST
On 9/28/26 15:28, djakov@xxxxxxxxxx wrote:
From: Georgi Djakov <djakov@xxxxxxxxxx>Applied, thanks
Fix the following issue noticed when booting on the db845c-dragonboard:
BUG: KASAN: global-out-of-bounds in qpnp_tm_sync_thresholds+0x11c/0x180 [qcom_spmi_temp_alarm]
Read of size 24 at addr ffffdd2495f01200 by task (udev-worker)/371
CPU: 3 UID: 0 PID: 371 Comm: (udev-worker) Not tainted 7.3.0-rc3 #116 PREEMPT
Hardware name: Thundercomm Dragonboard 845c (DT)
Call trace:
show_stack+0x18/0x24 (C)
dump_stack_lvl+0xa4/0xf4
print_report+0x1f4/0x5ac
kasan_report+0x84/0xcc
kasan_check_range+0xf0/0x1a4
memcpy+0x3c/0xa4
qpnp_tm_sync_thresholds+0x11c/0x180 [qcom_spmi_temp_alarm]
qpnp_tm_probe+0x3dc/0xae8 [qcom_spmi_temp_alarm]
platform_probe+0xc4/0x18c
really_probe+0x17c/0x4fc
...
The buggy address belongs to the variable:
temp_map_gen1+0x60/0xc4 [qcom_spmi_temp_alarm]
It looks like temp_map is a pointer to the complete temperature map.
Indexing it directly advances the entire map, rather than selecting a
threshold row.
Fix this by dereferencing the temp_map before indexing it to select the
requested threshold row.
Fixes: 703f13285a6c ("thermal/drivers/qcom-spmi-temp-alarm: Add temp alarm data struct based on HW subtype")
Fixes: 1f835c6a4c84 ("thermal/drivers/qcom-spmi-temp-alarm: Prepare to support additional Temp Alarm subtypes")
Signed-off-by: Georgi Djakov <djakov@xxxxxxxxxx>
---