diff options
| author | Rafael J. Wysocki <rafael.j.wysocki@intel.com> | 2024-10-03 14:27:28 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-11-08 16:28:16 +0100 |
| commit | eabe285e1c629a719d6e68fc319939c63b83bf22 (patch) | |
| tree | 75a180fac3871763ebd8f4fd91ffa2f1970ca299 /drivers/thermal | |
| parent | 3eb073abba32718ba72e72c54f99b1e114e2b81a (diff) | |
| download | linux-eabe285e1c629a719d6e68fc319939c63b83bf22.tar.gz linux-eabe285e1c629a719d6e68fc319939c63b83bf22.tar.bz2 linux-eabe285e1c629a719d6e68fc319939c63b83bf22.zip | |
thermal: core: Free tzp copy along with the thermal zone
[ Upstream commit 827a07525c099f54d3b15110408824541ec66b3c ]
The object pointed to by tz->tzp may still be accessed after being
freed in thermal_zone_device_unregister(), so move the freeing of it
to the point after the removal completion has been completed at which
it cannot be accessed any more.
Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure")
Cc: 6.8+ <stable@vger.kernel.org> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Link: https://patch.msgid.link/4623516.LvFx2qVVIh@rjwysocki.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/thermal')
| -rw-r--r-- | drivers/thermal/thermal_core.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 69b89a71f44e..d7ac7eef680e 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -1484,14 +1484,12 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) ida_destroy(&tz->ida); device_del(&tz->device); - - kfree(tz->tzp); - put_device(&tz->device); thermal_notify_tz_delete(tz_id); wait_for_completion(&tz->removal); + kfree(tz->tzp); kfree(tz); } EXPORT_SYMBOL_GPL(thermal_zone_device_unregister); |