]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs
authorDmitry Osipenko <digetx@gmail.com>
Mon, 13 Aug 2018 17:14:00 +0000 (20:14 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 21 Nov 2018 08:22:03 +0000 (09:22 +0100)
commitc5a92417978308ac8a551d07f99fb92c213756de
treea54c49224bb6d82df0ddd50c39955df7d0c6b365
parentbb34fbacd90ca34cc2f73844fbad5ebcd4a11a85
thermal: core: Fix use-after-free in thermal_cooling_device_destroy_sysfs

commit 3c587768271e9c20276522025729e4ebca51583b upstream.

This patch fixes use-after-free that was detected by KASAN. The bug is
triggered on a CPUFreq driver module unload by freeing 'cdev' on device
unregister and then using the freed structure during of the cdev's sysfs
data destruction. The solution is to unregister the sysfs at first, then
destroy sysfs data and finally release the cooling device.

Cc: <stable@vger.kernel.org> # v4.17+
Fixes: 8ea229511e06 ("thermal: Add cooling device's statistics in sysfs")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Acked-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/thermal/thermal_core.c