thermal: core: Fix use-after-free in thermal_zone_device_unregister() (a5f785ce) · Commits · 戴 / test

The user-after-free bug in thermal_zone_device_unregister() is reported by KASAN. It happens because struct thermal_zone_device is released during of device_unregister() invocation, and hence the "tz" variable shouldn't be touched by thermal_notify_tz_delete(tz->id). Fixes: ("thermal: core: Add notifications call in the framework") Signed-off-by:

Dmitry Osipenko <digetx@gmail.com> Signed-off-by:

Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20200817235854.26816-1-digetx@gmail.com

drivers/thermal/thermal_core.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -1516,7 +1516,7 @@ EXPORT_SYMBOL_GPL(thermal_zone_device_register);
		*/
		void thermal_zone_device_unregister(struct thermal_zone_device *tz)
		{
		int i;
		int i, tz_id;
		const struct thermal_zone_params *tzp;
		struct thermal_cooling_device *cdev;
		struct thermal_zone_device *pos = NULL;
		@@ -1525,6 +1525,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
		return;

		tzp = tz->tzp;
		tz_id = tz->id;

		mutex_lock(&thermal_list_lock);
		list_for_each_entry(pos, &thermal_tz_list, node)
		@@ -1567,7 +1568,7 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
		mutex_destroy(&tz->lock);
		device_unregister(&tz->device);

		thermal_notify_tz_delete(tz->id);
		thermal_notify_tz_delete(tz_id);
		}
		EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);

Admin message