Commit f8fafb69 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'thermal-6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm 

Pull thermal control fixes from Rafael Wysocki:
 "Address possible use-after-free scenarios during the processing of
  thermal netlink commands and during thermal zone removal (Rafael
  Wysocki)"

* tag 'thermal-6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: core: Free tzp copy along with the thermal zone
  thermal: core: Reference count the zone in thermal_zone_get_by_id()
parents 325354cf 827a0752

drivers/thermal/thermal_core.c

+2 −3
Original line number Diff line number Diff line
@@ -728,6 +728,7 @@ struct thermal_zone_device *thermal_zone_get_by_id(int id) 
	mutex_lock(&thermal_list_lock);

	list_for_each_entry(tz, &thermal_tz_list, node) {

		if (tz->id == id) {

			get_device(&tz->device);

			match = tz;

			break;

		}
@@ -1605,14 +1606,12 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) 
	ida_destroy(&tz->ida);



	device_del(&tz->device);



	kfree(tz->tzp);



	put_device(&tz->device);



	thermal_notify_tz_delete(tz);



	wait_for_completion(&tz->removal);

	kfree(tz->tzp);

	kfree(tz);

}

EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);

drivers/thermal/thermal_core.h

+3 −0
Original line number Diff line number Diff line
@@ -194,6 +194,9 @@ int for_each_thermal_governor(int (*cb)(struct thermal_governor *, void *), 


struct thermal_zone_device *thermal_zone_get_by_id(int id);



DEFINE_CLASS(thermal_zone_get_by_id, struct thermal_zone_device *,

	     if (_T) put_device(&_T->device), thermal_zone_get_by_id(id), int id)



static inline bool cdev_is_power_actor(struct thermal_cooling_device *cdev)

{

	return cdev->ops->get_requested_power && cdev->ops->state2power &&

drivers/thermal/thermal_netlink.c

+3 −6
Original line number Diff line number Diff line
@@ -443,7 +443,6 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) 
{

	struct sk_buff *msg = p->msg;

	const struct thermal_trip_desc *td;

	struct thermal_zone_device *tz;

	struct nlattr *start_trip;

	int id;
@@ -452,7 +451,7 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) 


	id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);



	tz = thermal_zone_get_by_id(id);

	CLASS(thermal_zone_get_by_id, tz)(id);

	if (!tz)

		return -EINVAL;
@@ -488,7 +487,6 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) 
static int thermal_genl_cmd_tz_get_temp(struct param *p)

{

	struct sk_buff *msg = p->msg;

	struct thermal_zone_device *tz;

	int temp, ret, id;



	if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
@@ -496,7 +494,7 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) 


	id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);



	tz = thermal_zone_get_by_id(id);

	CLASS(thermal_zone_get_by_id, tz)(id);

	if (!tz)

		return -EINVAL;
@@ -514,7 +512,6 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) 
static int thermal_genl_cmd_tz_get_gov(struct param *p)

{

	struct sk_buff *msg = p->msg;

	struct thermal_zone_device *tz;

	int id, ret = 0;



	if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
@@ -522,7 +519,7 @@ static int thermal_genl_cmd_tz_get_gov(struct param *p) 


	id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);



	tz = thermal_zone_get_by_id(id);

	CLASS(thermal_zone_get_by_id, tz)(id);

	if (!tz)

		return -EINVAL;