| Message ID | 1380652688-5787-2-git-send-email-durgadoss.r@intel.com (mailing list archive) |
|---|---|
| State | Deferred, archived |
| Delegated to: | Zhang Rui |
| Headers | show |
On Wed, 2013-10-02 at 00:08 +0530, Durgadoss R wrote: > The thermal_release function is called whenever > any device belonging to 'thermal' class unregisters. > This function performs kfree(cdev) without any check. > In cases where there are more device registrations > other than just 'thermal_zone' and 'cooling_device' > this might accidently free memory allocated them > silently; and cause memory errors. > > This patch changes this behavior by doing > kfree(cdev) only when the device pointer belongs > to a real cdev i.e. cooling_device. > > Signed-off-by: Durgadoss R <durgadoss.r@intel.com> applied to thermal -next. thanks, rui > --- > drivers/thermal/thermal_core.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c > index 1f02e8e..8c5131d 100644 > --- a/drivers/thermal/thermal_core.c > +++ b/drivers/thermal/thermal_core.c > @@ -1280,7 +1280,8 @@ static void thermal_release(struct device *dev) > sizeof("thermal_zone") - 1)) { > tz = to_thermal_zone(dev); > kfree(tz); > - } else { > + } else if(!strncmp(dev_name(dev), "cooling_device", > + sizeof("cooling_device") - 1)){ > cdev = to_cooling_device(dev); > kfree(cdev); > } -- To unsubscribe from this list: send the line "unsubscribe linux-pm" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 1f02e8e..8c5131d 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -1280,7 +1280,8 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); kfree(tz); - } else { + } else if(!strncmp(dev_name(dev), "cooling_device", + sizeof("cooling_device") - 1)){ cdev = to_cooling_device(dev); kfree(cdev); }
The thermal_release function is called whenever any device belonging to 'thermal' class unregisters. This function performs kfree(cdev) without any check. In cases where there are more device registrations other than just 'thermal_zone' and 'cooling_device' this might accidently free memory allocated them silently; and cause memory errors. This patch changes this behavior by doing kfree(cdev) only when the device pointer belongs to a real cdev i.e. cooling_device. Signed-off-by: Durgadoss R <durgadoss.r@intel.com> --- drivers/thermal/thermal_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)