On Tue, Oct 31, 2023 at 10:53 AM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> The acpi_thermal_unregister_thermal_zone() is paired with
> acpi_thermal_register_thermal_zone() so it should mirror it. It should
> clean up all the resources that the register function allocated and
> leave the stuff that was allocated elsewhere.
>
> Unfortunately, it doesn't call thermal_zone_device_disable(). Also it
> calls kfree(tz->trip_table) when it shouldn't. That was allocated in
> acpi_thermal_add(). Putting the kfree() here leads to a double free
> in the acpi_thermal_add() clean up function.
>
> Likewise, the acpi_thermal_remove() should mirror acpi_thermal_add() so
> it should have an explicit kfree(tz->trip_table) as well.
>
> Fixes: ec23c1c462de ("ACPI: thermal: Use trip point table to register thermal zones")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
> drivers/acpi/thermal.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
> index d98ff69303b3..f74d81abdbfc 100644
> --- a/drivers/acpi/thermal.c
> +++ b/drivers/acpi/thermal.c
> @@ -702,9 +702,9 @@ static int acpi_thermal_register_thermal_zone(struct acpi_thermal *tz,
>
> static void acpi_thermal_unregister_thermal_zone(struct acpi_thermal *tz)
> {
> + thermal_zone_device_disable(tz->thermal_zone);
> acpi_thermal_zone_sysfs_remove(tz);
> thermal_zone_device_unregister(tz->thermal_zone);
> - kfree(tz->trip_table);
> tz->thermal_zone = NULL;
> }
>
> @@ -967,7 +967,7 @@ static void acpi_thermal_remove(struct acpi_device *device)
>
> flush_workqueue(acpi_thermal_pm_queue);
> acpi_thermal_unregister_thermal_zone(tz);
> -
> + kfree(tz->trip_table);
> acpi_thermal_free_thermal_zone(tz);
> }
>
> --
Applied, thanks!
