thermal: check array index when set cur_state [1/1]

PD#SWPL-8747

Problem:
android.security.sts.Poc17_11#testPocCVE_2017_6264
test echo /sys/devices/virtual/thermal/cooling_device2/cur_state
crash

Solution:
check array index

Verify:
verified by u212

Change-Id: I235d62508d95fffaed7b811ba008384db7c7ec6f
Signed-off-by: Wencai You <wencai.you@amlogic.com>

diff --git a/drivers/amlogic/thermal/gpu_cooling.c b/drivers/amlogic/thermal/gpu_cooling.c
index 6d9fe35..04f3115 100644 (file)
--- a/drivers/amlogic/thermal/gpu_cooling.c
+++ b/drivers/amlogic/thermal/gpu_cooling.c
@@ -151,8 +151,10 @@ static int gpufreq_set_cur_state(struct thermal_cooling_device *cdev,
                 state, gpufreq_device->gpufreq_state);
        /* if (gpufreq_device->gpufreq_state == state) */
                /* return 0; */
-       gpufreq_device->gpufreq_state = state;
        ret = gpufreq_get_max_state(cdev, &max_state);
+       if (state > max_state-1)
+               state = max_state-1;
+       gpufreq_device->gpufreq_state = state;
        state = max_state-1-state;
 
        pr_debug("state=%ld,gpufreq_device->gpufreq_state=%d\n",