From dcadd87919b5162408ea04207bc821a31eb4ec48 Mon Sep 17 00:00:00 2001
From: wanggang26 <wanggang26@xiaomi.com>
Date: Mon, 11 Sep 2023 12:47:04 +0800
Subject: [PATCH] pm: fix issue that system crash when passed invalid relpath
 value

Signed-off-by: wanggang26 <wanggang26@xiaomi.com>
---
 drivers/power/pm/pm_procfs.c | 47 +++++++++++++++++++++++++++---------
 1 file changed, 36 insertions(+), 11 deletions(-)

diff --git a/drivers/power/pm/pm_procfs.c b/drivers/power/pm/pm_procfs.c
index f76e70e6c13..eba85b3b91e 100644
--- a/drivers/power/pm/pm_procfs.c
+++ b/drivers/power/pm/pm_procfs.c
@@ -114,6 +114,8 @@ static int     pm_rewinddir(FAR struct fs_dirent_s *dir);
 
 static int     pm_stat(FAR const char *relpath, FAR struct stat *buf);
 
+static int     pm_get_file_index(FAR const char *relpath);
+
 /****************************************************************************
  * Public Data
  ****************************************************************************/
@@ -159,6 +161,26 @@ static FAR const char *g_pm_state[PM_COUNT] =
  * Private Functions
  ****************************************************************************/
 
+/****************************************************************************
+ * Name: pm_get_file_index
+ ****************************************************************************/
+
+static int pm_get_file_index(FAR const char *relpath)
+{
+  int i;
+
+  for (i = 0; i < nitems(g_pm_files); i++)
+    {
+      if (strncmp(relpath, g_pm_files[i].name,
+                  strlen(g_pm_files[i].name)) == 0)
+        {
+          return i;
+        }
+    }
+
+  return -1;
+}
+
 /****************************************************************************
  * Name: pm_open
  ****************************************************************************/
@@ -181,6 +203,13 @@ static int pm_open(FAR struct file *filep, FAR const char *relpath,
       return -EACCES;
     }
 
+  relpath += strlen("pm/");
+  i = pm_get_file_index(relpath);
+  if (i < 0)
+    {
+      return -ENOENT;
+    }
+
   /* Allocate a container to hold the file attributes */
 
   pmfile = kmm_zalloc(sizeof(struct pm_file_s));
@@ -190,17 +219,7 @@ static int pm_open(FAR struct file *filep, FAR const char *relpath,
       return -ENOMEM;
     }
 
-  relpath += strlen("pm/");
-  for (i = 0; i < nitems(g_pm_files); i++)
-    {
-      if (strncmp(relpath, g_pm_files[i].name,
-                  strlen(g_pm_files[i].name)) == 0)
-        {
-          pmfile->read = g_pm_files[i].read;
-          break;
-        }
-    }
-
+  pmfile->read = g_pm_files[i].read;
   pmfile->domain = atoi(relpath + strlen(g_pm_files[i].name));
 
   DEBUGASSERT(pmfile->read);
@@ -555,6 +574,12 @@ static int pm_stat(FAR const char *relpath, FAR struct stat *buf)
     }
   else
     {
+      relpath += strlen("pm/");
+      if (pm_get_file_index(relpath) < 0)
+        {
+          return -ENOENT;
+        }
+
       buf->st_mode = S_IFREG | S_IROTH | S_IRGRP | S_IRUSR;
     }