| Message ID | 1461234295-30521-1-git-send-email-dirk.behme@de.bosch.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Geert Uytterhoeven |
| Headers | show |
On Thu, Apr 21, 2016 at 12:24 PM, Dirk Behme <dirk.behme@de.bosch.com> wrote: > In case thermal_zone_xxx_register() returns an error, priv->zone > isn't NULL any more, but contains the error code. > > This is passed to thermal_zone_device_unregister(), then. This checks > for priv->zone being NULL, but the error code is != NULL. So it works > with the error code as a pointer. Crashing immediately. > > To fix this, reset priv->zone to NULL before entering > rcar_gen3_thermal_remove(). Alternatively, you could prevent a non-valid zone pointer from ever ending up in priv->zone by assigning the zone to a temporary variable, and only storing that in priv->zone after the error check. > Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com> Regardless of the above Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
On 21.04.2016 15:00, Geert Uytterhoeven wrote: > On Thu, Apr 21, 2016 at 12:24 PM, Dirk Behme <dirk.behme@de.bosch.com> wrote: >> In case thermal_zone_xxx_register() returns an error, priv->zone >> isn't NULL any more, but contains the error code. >> >> This is passed to thermal_zone_device_unregister(), then. This checks >> for priv->zone being NULL, but the error code is != NULL. So it works >> with the error code as a pointer. Crashing immediately. >> >> To fix this, reset priv->zone to NULL before entering >> rcar_gen3_thermal_remove(). > > Alternatively, you could prevent a non-valid zone pointer from ever > ending up in priv->zone by assigning the zone to a temporary variable, > and only storing that in priv->zone after the error check. > >> Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com> > > Regardless of the above > Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Could this be applied, then? Best regards Dirk
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c index 71a3392..5f81792 100644 --- a/drivers/thermal/rcar_thermal.c +++ b/drivers/thermal/rcar_thermal.c @@ -504,6 +504,7 @@ static int rcar_thermal_probe(struct platform_device *pdev) if (IS_ERR(priv->zone)) { dev_err(dev, "can't register thermal zone\n"); ret = PTR_ERR(priv->zone); + priv->zone = NULL; goto error_unregister; }
In case thermal_zone_xxx_register() returns an error, priv->zone isn't NULL any more, but contains the error code. This is passed to thermal_zone_device_unregister(), then. This checks for priv->zone being NULL, but the error code is != NULL. So it works with the error code as a pointer. Crashing immediately. To fix this, reset priv->zone to NULL before entering rcar_gen3_thermal_remove(). Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com> --- drivers/thermal/rcar_thermal.c | 1 + 1 file changed, 1 insertion(+)