korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-14 07:44:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Thermal control fixes for 6.12-rc3

Browse Source 
Address possible use-after-free scenarios during the processing of
 thermal netlink commands and during thermal zone removal (Rafael
 Wysocki).
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAmcJQWASHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxrJ4QAI4OIRUZ6fmpAicQ6IRYSwq/rv7cCkyy
 Q3vwLHVq9liG0exD2IKR/fmloIpl3yL9JK1UNY/U4Qfg0diro0iHrZmnpgJ3ecSo
 hkvf9hiAF5e03+ugIXjOBJAOF0x9/Z1tdOUJq31IP9BeoclD62Mbc0qB5QsnPPqK
 2dv3IlXuY7yqizHLWczAkQw9ELUHHiepMuUSvsGp8WTTdwtSOhQJNP4bl/sbYFWI
 0ZBNdt+fk2ivkqAo3iG0rqwK6KlSbSLpms3XDjyJLEtIGlAeKaaq54686GxnkGDL
 JRRqR3prTjvf5ITFCi4rgac+YknOjFk4kIuoh8khwS1ijSwxiguGjd14N2QeLzon
 ouxP/+C6P4NXRcUS4aPz3zUZp3fRgucthE13LtYrITQLifmsnHUTKvzRxB0d8DDr
 K9U4oYUj+V4i90bK16snelfPhZRkL31cu+osgK47jjXpiuZwHhPAEHzGNbGTo9zq
 55r8P877uAsOtu10MdxSIlo035xXSxOZl3zzxpS0OHaOyymh51O43+JQQXtgxrQ0
 nudtTZL5xJmy/I3mljljAMhFEAwJeiHpYigJmcbQfirhauQhzHUbcYzL5aEh90v/
 6tXH8p9gOekkcV4s6GKkoESqK+c/C1Pvx/ZXPSz/j3w0UJnVvZEHVBDNMONVzBx9
 PiStFRsoXl7T
 =IVMx
 -----END PGP SIGNATURE-----

Merge tag 'thermal-6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull thermal control fixes from Rafael Wysocki:
 "Address possible use-after-free scenarios during the processing of
  thermal netlink commands and during thermal zone removal (Rafael
  Wysocki)"

* tag 'thermal-6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: core: Free tzp copy along with the thermal zone
  thermal: core: Reference count the zone in thermal_zone_get_by_id()
This commit is contained in:
Linus Torvalds 2024-10-11 11:35:30 -07:00
commit f8fafb690b
3 changed files with 8 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/thermal/thermal_core.c
View File

@ -728,6 +728,7 @@ struct thermal_zone_device *thermal_zone_get_by_id(int id)
mutex_lock(&thermal_list_lock);
list_for_each_entry(tz, &thermal_tz_list, node) {
if (tz->id == id) {
get_device(&tz->device);
match = tz;
break;
}
@ -1605,14 +1606,12 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
ida_destroy(&tz->ida);
device_del(&tz->device);
kfree(tz->tzp);
put_device(&tz->device);
thermal_notify_tz_delete(tz);
wait_for_completion(&tz->removal);
kfree(tz->tzp);
kfree(tz);
}
EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);

3
drivers/thermal/thermal_core.h
View File

@ -194,6 +194,9 @@ int for_each_thermal_governor(int (*cb)(struct thermal_governor *, void *),
struct thermal_zone_device *thermal_zone_get_by_id(int id);
DEFINE_CLASS(thermal_zone_get_by_id, struct thermal_zone_device *,
if (_T) put_device(&_T->device), thermal_zone_get_by_id(id), int id)
static inline bool cdev_is_power_actor(struct thermal_cooling_device *cdev)
{
return cdev->ops->get_requested_power && cdev->ops->state2power &&

9
drivers/thermal/thermal_netlink.c
View File

@ -443,7 +443,6 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p)
{
struct sk_buff *msg = p->msg;
const struct thermal_trip_desc *td;
struct thermal_zone_device *tz;
struct nlattr *start_trip;
int id;
@ -452,7 +451,7 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p)
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
tz = thermal_zone_get_by_id(id);
CLASS(thermal_zone_get_by_id, tz)(id);
if (!tz)
return -EINVAL;
@ -488,7 +487,6 @@ out_cancel_nest:
static int thermal_genl_cmd_tz_get_temp(struct param *p)
{
struct sk_buff *msg = p->msg;
struct thermal_zone_device *tz;
int temp, ret, id;
if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
@ -496,7 +494,7 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p)
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
tz = thermal_zone_get_by_id(id);
CLASS(thermal_zone_get_by_id, tz)(id);
if (!tz)
return -EINVAL;
@ -514,7 +512,6 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p)
static int thermal_genl_cmd_tz_get_gov(struct param *p)
{
struct sk_buff *msg = p->msg;
struct thermal_zone_device *tz;
int id, ret = 0;
if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
@ -522,7 +519,7 @@ static int thermal_genl_cmd_tz_get_gov(struct param *p)
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
tz = thermal_zone_get_by_id(id);
CLASS(thermal_zone_get_by_id, tz)(id);
if (!tz)
return -EINVAL;