* [bug report] thermal/debugfs: Add thermal cooling device debugfs information
@ 2024-01-12 8:13 Dan Carpenter
2024-01-12 14:50 ` Rafael J. Wysocki
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2024-01-12 8:13 UTC (permalink / raw)
To: daniel.lezcano; +Cc: linux-pm
Hello Daniel Lezcano,
The patch 90f2fb4afe8b: "thermal/debugfs: Add thermal cooling device
debugfs information" from Jan 9, 2024 (linux-next), leads to the
following Smatch static checker warning:
drivers/thermal/thermal_debugfs.c:517 thermal_debug_cdev_remove() warn: 'thermal_dbg' was already freed. (line 515)
drivers/thermal/thermal_debugfs.c:835 thermal_debug_tz_remove() warn: 'thermal_dbg' was already freed. (line 833)
drivers/thermal/thermal_debugfs.c
504 void thermal_debug_cdev_remove(struct thermal_cooling_device *cdev)
505 {
506 struct thermal_debugfs *thermal_dbg = cdev->debugfs;
507
508 if (!thermal_dbg)
509 return;
510
511 mutex_lock(&thermal_dbg->lock);
512
513 thermal_debugfs_cdev_clear(&thermal_dbg->cdev_dbg);
514 cdev->debugfs = NULL;
515 thermal_debugfs_remove_id(thermal_dbg);
^^^^^^^^^^^
Freed here.
516
--> 517 mutex_unlock(&thermal_dbg->lock);
^^^^^^^^^^^^^^^^^^
Use after free. Same issue in the tz remove() function.
518 }
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [bug report] thermal/debugfs: Add thermal cooling device debugfs information
2024-01-12 8:13 [bug report] thermal/debugfs: Add thermal cooling device debugfs information Dan Carpenter
@ 2024-01-12 14:50 ` Rafael J. Wysocki
0 siblings, 0 replies; 2+ messages in thread
From: Rafael J. Wysocki @ 2024-01-12 14:50 UTC (permalink / raw)
To: Dan Carpenter; +Cc: daniel.lezcano, linux-pm
On Fri, Jan 12, 2024 at 9:13 AM Dan Carpenter <dan.carpenter@linaro.org> wrote:
>
> Hello Daniel Lezcano,
>
> The patch 90f2fb4afe8b: "thermal/debugfs: Add thermal cooling device
> debugfs information" from Jan 9, 2024 (linux-next), leads to the
> following Smatch static checker warning:
>
> drivers/thermal/thermal_debugfs.c:517 thermal_debug_cdev_remove() warn: 'thermal_dbg' was already freed. (line 515)
> drivers/thermal/thermal_debugfs.c:835 thermal_debug_tz_remove() warn: 'thermal_dbg' was already freed. (line 833)
>
> drivers/thermal/thermal_debugfs.c
> 504 void thermal_debug_cdev_remove(struct thermal_cooling_device *cdev)
> 505 {
> 506 struct thermal_debugfs *thermal_dbg = cdev->debugfs;
> 507
> 508 if (!thermal_dbg)
> 509 return;
> 510
> 511 mutex_lock(&thermal_dbg->lock);
> 512
> 513 thermal_debugfs_cdev_clear(&thermal_dbg->cdev_dbg);
> 514 cdev->debugfs = NULL;
> 515 thermal_debugfs_remove_id(thermal_dbg);
> ^^^^^^^^^^^
> Freed here.
>
> 516
> --> 517 mutex_unlock(&thermal_dbg->lock);
> ^^^^^^^^^^^^^^^^^^
> Use after free. Same issue in the tz remove() function.
>
> 518 }
>
Good catch, thanks!
Fixed up in the tree.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-01-12 14:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-01-12 8:13 [bug report] thermal/debugfs: Add thermal cooling device debugfs information Dan Carpenter
2024-01-12 14:50 ` Rafael J. Wysocki
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox