thermal: core: Free tzp copy along with the thermal zone

The object pointed to by tz->tzp may still be accessed after being
freed in thermal_zone_device_unregister(), so move the freeing of it
to the point after the removal completion has been completed at which
it cannot be accessed any more.

Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure")
Cc: 6.8+ <stable@vger.kernel.org> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Link: https://patch.msgid.link/4623516.LvFx2qVVIh@rjwysocki.net

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index c69f8123fb73a93b917dfd56f004712e51a51933..8f03985f971c3058dc1ed6018d8d3dea86b733bc 100644 (file)
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1606,14 +1606,12 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
        ida_destroy(&tz->ida);
 
        device_del(&tz->device);
-
-       kfree(tz->tzp);
-
        put_device(&tz->device);
 
        thermal_notify_tz_delete(tz);
 
        wait_for_completion(&tz->removal);
+       kfree(tz->tzp);
        kfree(tz);
 }
 EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);