Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'thermal-6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull thermal control fixes from Rafael Wysocki:
"Address possible use-after-free scenarios during the processing of
thermal netlink commands and during thermal zone removal (Rafael
Wysocki)"
* tag 'thermal-6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
thermal: core: Free tzp copy along with the thermal zone
thermal: core: Reference count the zone in thermal_zone_get_by_id()
+8
-9
+2
-3
drivers/thermal/thermal_core.c
+2
-3
drivers/thermal/thermal_core.c
···
728
728
mutex_lock(&thermal_list_lock);
729
729
list_for_each_entry(tz, &thermal_tz_list, node) {
730
730
if (tz->id == id) {
731
+
get_device(&tz->device);
731
732
match = tz;
732
733
break;
733
734
}
···
1606
1605
ida_destroy(&tz->ida);
1607
1606
1608
1607
device_del(&tz->device);
1609
-
1610
-
kfree(tz->tzp);
1611
-
1612
1608
put_device(&tz->device);
1613
1609
1614
1610
thermal_notify_tz_delete(tz);
1615
1611
1616
1612
wait_for_completion(&tz->removal);
1613
+
kfree(tz->tzp);
1617
1614
kfree(tz);
1618
1615
}
1619
1616
EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);
+3
drivers/thermal/thermal_core.h
+3
drivers/thermal/thermal_core.h
···
194
194
195
195
struct thermal_zone_device *thermal_zone_get_by_id(int id);
196
196
197
+
DEFINE_CLASS(thermal_zone_get_by_id, struct thermal_zone_device *,
198
+
if (_T) put_device(&_T->device), thermal_zone_get_by_id(id), int id)
199
+
197
200
static inline bool cdev_is_power_actor(struct thermal_cooling_device *cdev)
198
201
{
199
202
return cdev->ops->get_requested_power && cdev->ops->state2power &&
+3
-6
drivers/thermal/thermal_netlink.c
+3
-6
drivers/thermal/thermal_netlink.c
···
443
443
{
444
444
struct sk_buff *msg = p->msg;
445
445
const struct thermal_trip_desc *td;
446
-
struct thermal_zone_device *tz;
447
446
struct nlattr *start_trip;
448
447
int id;
449
448
···
451
452
452
453
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
453
454
454
-
tz = thermal_zone_get_by_id(id);
455
+
CLASS(thermal_zone_get_by_id, tz)(id);
455
456
if (!tz)
456
457
return -EINVAL;
457
458
···
487
488
static int thermal_genl_cmd_tz_get_temp(struct param *p)
488
489
{
489
490
struct sk_buff *msg = p->msg;
490
-
struct thermal_zone_device *tz;
491
491
int temp, ret, id;
492
492
493
493
if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
···
494
496
495
497
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
496
498
497
-
tz = thermal_zone_get_by_id(id);
499
+
CLASS(thermal_zone_get_by_id, tz)(id);
498
500
if (!tz)
499
501
return -EINVAL;
500
502
···
512
514
static int thermal_genl_cmd_tz_get_gov(struct param *p)
513
515
{
514
516
struct sk_buff *msg = p->msg;
515
-
struct thermal_zone_device *tz;
516
517
int id, ret = 0;
517
518
518
519
if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
···
519
522
520
523
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
521
524
522
-
tz = thermal_zone_get_by_id(id);
525
+
CLASS(thermal_zone_get_by_id, tz)(id);
523
526
if (!tz)
524
527
return -EINVAL;
525
528