Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f3bdd4f authored by Axel Lin's avatar Axel Lin Committed by Rafael J. Wysocki
Browse files

PM / devfreq: fix use after free in devfreq_remove_device 



In devfreq_remove_device, calling _remove_devfreq will also free devfreq.
Don't dereference devfreq->governor->no_central_polling after _remove_devfreq.

Signed-off-by: default avatarAxel Lin <axel.lin@gmail.com>
Acked-by: default avatarMyungJoo Ham <myungjoo.ham@samsung.com>
Signed-off-by: default avatarRafael J. Wysocki <rjw@sisk.pl>
parent bc9f5449

drivers/devfreq/devfreq.c

+6 −2
Original line number Diff line number Diff line
@@ -418,10 +418,14 @@ struct devfreq *devfreq_add_device(struct device *dev, 
 */

int devfreq_remove_device(struct devfreq *devfreq)

{

	bool central_polling;



	if (!devfreq)

		return -EINVAL;



	if (!devfreq->governor->no_central_polling) {

	central_polling = !devfreq->governor->no_central_polling;



	if (central_polling) {

		mutex_lock(&devfreq_list_lock);

		while (wait_remove_device == devfreq) {

			mutex_unlock(&devfreq_list_lock);
@@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq) 
	mutex_lock(&devfreq->lock);

	_remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */



	if (!devfreq->governor->no_central_polling)

	if (central_polling)

		mutex_unlock(&devfreq_list_lock);



	return 0;