Re: [bug report] thermal/debugfs: Add thermal cooling device debugfs information

Rafael J. Wysocki
2024-01-12T14:50:34Z

On Fri, Jan 12, 2024 at 9:13 AM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> Hello Daniel Lezcano,
>
> The patch 90f2fb4afe8b: "thermal/debugfs: Add thermal cooling device
> debugfs information" from Jan 9, 2024 (linux-next), leads to the
> following Smatch static checker warning:
>
> drivers/thermal/thermal_debugfs.c:517 thermal_debug_cdev_remove() warn: 'thermal_dbg' was already freed. (line 515)
> drivers/thermal/thermal_debugfs.c:835 thermal_debug_tz_remove() warn: 'thermal_dbg' was already freed. (line 833)
>
> drivers/thermal/thermal_debugfs.c
> 504 void thermal_debug_cdev_remove(struct thermal_cooling_device *cdev)
> 505 {
> 506 struct thermal_debugfs *thermal_dbg = cdev->debugfs;
> 507
> 508 if (!thermal_dbg)
> 509 return;
> 510
> 511 mutex_lock(&thermal_dbg->lock);
> 512
> 513 thermal_debugfs_cdev_clear(&thermal_dbg->cdev_dbg);
> 514 cdev->debugfs = NULL;
> 515 thermal_debugfs_remove_id(thermal_dbg);
> ^^^^^^^^^^^
> Freed here.
>
> 516
> --> 517 mutex_unlock(&thermal_dbg->lock);
> ^^^^^^^^^^^^^^^^^^
> Use after free. Same issue in the tz remove() function.
>
> 518 }
>

Good catch, thanks!

Fixed up in the tree.