[PATCH] thermal: intel: int340x: bound the PATC trip count

[Kang Chen]

int340x_thermal_zone_add() adds the value returned by PATC to
INT340X_THERMAL_MAX_TRIP_COUNT without checking for overflow, and then
uses the same 64-bit value as the allocation size, as the loop bound,
and as an int argument to int340x_thermal_read_trips().  A PATC value
of U64_MAX makes the allocation count wrap to 12, while the fill loop
still runs for U64_MAX iterations and writes far beyond the allocated
array.  Values above INT_MAX are also truncated when passed to
int340x_thermal_read_trips() and stored in aux_trip_nr.

Also add parentheses to INT340X_THERMAL_MAX_TRIP_COUNT so that the
macro can be used in expressions safely.

Ignore values that cannot be represented as an int after adding room
for the fixed trip points, so the zone still registers with its fixed
trip points.

Fixes: f4118dbe61bb3 ("thermal: intel: int340x: Use generic trip points table")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 .../thermal/intel/int340x_thermal/int340x_thermal_zone.c | 9 ++++++++-
 .../thermal/intel/int340x_thermal/int340x_thermal_zone.h | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c b/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c
index 965700ee6962..6eda7823a7e2 100644
--- a/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c
+++ b/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c
@@ -130,8 +130,15 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,
 	int34x_zone->adev = adev;
 
 	status = acpi_evaluate_integer(adev->handle, "PATC", NULL, &trip_cnt);
-	if (ACPI_SUCCESS(status))
+	if (ACPI_SUCCESS(status)) {
+		if (trip_cnt > INT_MAX - INT340X_THERMAL_MAX_TRIP_COUNT) {
+			acpi_handle_warn(adev->handle,
+					 "Invalid PATC value %llu, ignoring\n",
+					 trip_cnt);
+			trip_cnt = 0;
+		}
 		int34x_zone->aux_trip_nr = trip_cnt;
+	}
 
 	zone_trips = kzalloc_objs(*zone_trips,
 				  trip_cnt + INT340X_THERMAL_MAX_TRIP_COUNT);
diff --git a/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.h b/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.h
index d504e271009a..b1da47cc5402 100644
--- a/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.h
+++ b/drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.h
@@ -10,7 +10,7 @@
 #include <acpi/acpi_lpat.h>
 
 #define INT340X_THERMAL_MAX_ACT_TRIP_COUNT	10
-#define INT340X_THERMAL_MAX_TRIP_COUNT INT340X_THERMAL_MAX_ACT_TRIP_COUNT + 3
+#define INT340X_THERMAL_MAX_TRIP_COUNT (INT340X_THERMAL_MAX_ACT_TRIP_COUNT + 3)
 
 struct active_trip {
 	int temp;
-- 
2.34.1