[PATCH] thermal: rcar_thermal: Fix priv->zone error handling

[PATCH] thermal: rcar_thermal: Fix priv->zone error handling

[Dirk Behme]

In case thermal_zone_xxx_register() returns an error, priv->zone
isn't NULL any more, but contains the error code.

This is passed to thermal_zone_device_unregister(), then. This checks
for priv->zone being NULL, but the error code is != NULL. So it works
with the error code as a pointer. Crashing immediately.

To fix this, reset priv->zone to NULL before entering
rcar_gen3_thermal_remove().

Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
---
 drivers/thermal/rcar_thermal.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 71a3392..5f81792 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -504,6 +504,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
 		if (IS_ERR(priv->zone)) {
 			dev_err(dev, "can't register thermal zone\n");
 			ret = PTR_ERR(priv->zone);
+			priv->zone = NULL;
 			goto error_unregister;
 		}
 
-- 
2.8.0

Re: [PATCH] thermal: rcar_thermal: Fix priv->zone error handling

[Geert Uytterhoeven]

On Thu, Apr 21, 2016 at 12:24 PM, Dirk Behme <dirk.behme@de.bosch.com> wrote:
> In case thermal_zone_xxx_register() returns an error, priv->zone
> isn't NULL any more, but contains the error code.
>
> This is passed to thermal_zone_device_unregister(), then. This checks
> for priv->zone being NULL, but the error code is != NULL. So it works
> with the error code as a pointer. Crashing immediately.
>
> To fix this, reset priv->zone to NULL before entering
> rcar_gen3_thermal_remove().

Alternatively, you could prevent a non-valid zone pointer from ever
ending up in priv->zone by assigning the zone to a temporary variable,
and only storing that in priv->zone after the error check.

> Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>

Regardless of the above
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Re: [PATCH] thermal: rcar_thermal: Fix priv->zone error handling

[Dirk Behme]

On 21.04.2016 15:00, Geert Uytterhoeven wrote:
> On Thu, Apr 21, 2016 at 12:24 PM, Dirk Behme <dirk.behme@de.bosch.com> wrote:
>> In case thermal_zone_xxx_register() returns an error, priv->zone
>> isn't NULL any more, but contains the error code.
>>
>> This is passed to thermal_zone_device_unregister(), then. This checks
>> for priv->zone being NULL, but the error code is != NULL. So it works
>> with the error code as a pointer. Crashing immediately.
>>
>> To fix this, reset priv->zone to NULL before entering
>> rcar_gen3_thermal_remove().
>
> Alternatively, you could prevent a non-valid zone pointer from ever
> ending up in priv->zone by assigning the zone to a temporary variable,
> and only storing that in priv->zone after the error check.
>
>> Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
>
> Regardless of the above
> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>


Could this be applied, then?


Best regards

Dirk