summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDmitry Osipenko <digetx@gmail.com>2018-08-13 20:14:00 +0300
committerZhang Rui <rui.zhang@intel.com>2018-10-10 11:44:52 +0800
commit3c587768271e9c20276522025729e4ebca51583b (patch)
treef82b5120fc133b3eb0f02cc0a18ef2def4b5d9b2
parent0238df646e6224016a45505d2c111a24669ebe21 (diff)
downloadlinux-3c587768271e9c20276522025729e4ebca51583b.tar.bz2
thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs
This patch fixes use-after-free that was detected by KASAN. The bug is triggered on a CPUFreq driver module unload by freeing 'cdev' on device unregister and then using the freed structure during of the cdev's sysfs data destruction. The solution is to unregister the sysfs at first, then destroy sysfs data and finally release the cooling device. Cc: <stable@vger.kernel.org> # v4.17+ Fixes: 8ea229511e06 ("thermal: Add cooling device's statistics in sysfs") Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Acked-by: Viresh Kumar <viresh.kumar@linaro.org> Acked-by: Eduardo Valentin <edubezval@gmail.com> Signed-off-by: Zhang Rui <rui.zhang@intel.com>
-rw-r--r--drivers/thermal/thermal_core.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 6ab982309e6a..441778100887 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1102,8 +1102,9 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev)
mutex_unlock(&thermal_list_lock);
ida_simple_remove(&thermal_cdev_ida, cdev->id);
- device_unregister(&cdev->device);
+ device_del(&cdev->device);
thermal_cooling_device_destroy_sysfs(cdev);
+ put_device(&cdev->device);
}
EXPORT_SYMBOL_GPL(thermal_cooling_device_unregister);