Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2561c45b authored by Dmitry Osipenko's avatar Dmitry Osipenko Committed by Greg Kroah-Hartman
Browse files

thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs 



commit 3c587768271e9c20276522025729e4ebca51583b upstream.

This patch fixes use-after-free that was detected by KASAN. The bug is
triggered on a CPUFreq driver module unload by freeing 'cdev' on device
unregister and then using the freed structure during of the cdev's sysfs
data destruction. The solution is to unregister the sysfs at first, then
destroy sysfs data and finally release the cooling device.

Cc: <stable@vger.kernel.org> # v4.17+
Fixes: 8ea22951 ("thermal: Add cooling device's statistics in sysfs")
Signed-off-by: default avatarDmitry Osipenko <digetx@gmail.com>
Acked-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
Acked-by: default avatarEduardo Valentin <edubezval@gmail.com>
Signed-off-by: default avatarZhang Rui <rui.zhang@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e2496105

drivers/thermal/thermal_core.c

+2 −1
Original line number Diff line number Diff line
@@ -1102,8 +1102,9 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev) 
	mutex_unlock(&thermal_list_lock);



	ida_simple_remove(&thermal_cdev_ida, cdev->id);

	device_unregister(&cdev->device);

	device_del(&cdev->device);

	thermal_cooling_device_destroy_sysfs(cdev);

	put_device(&cdev->device);

}

EXPORT_SYMBOL_GPL(thermal_cooling_device_unregister);