From: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx>
commit 827a07525c099f54d3b15110408824541ec66b3c upstream.
The object pointed to by tz->tzp may still be accessed after being
freed in thermal_zone_device_unregister(), so move the freeing of it
to the point after the removal completion has been completed at which
it cannot be accessed any more.
Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure")
Cc: 6.8+ <stable@xxxxxxxxxxxxxxx> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx>
Reviewed-by: Lukasz Luba <lukasz.luba@xxxxxxx>
Link: https://patch.msgid.link/4623516.LvFx2qVVIh@xxxxxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/thermal/thermal_core.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1647,14 +1647,12 @@ void thermal_zone_device_unregister(stru
ida_destroy(&tz->ida);
device_del(&tz->device);
-
- kfree(tz->tzp);
-
put_device(&tz->device);
thermal_notify_tz_delete(tz);
wait_for_completion(&tz->removal);
+ kfree(tz->tzp);
kfree(tz);
}
EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);
Patches currently in stable-queue which might be from rafael.j.wysocki@xxxxxxxxx are
queue-6.11/acpi-resource-make-asus-expertbook-b2502-matches-cover-more-models.patch
queue-6.11/acpi-resource-make-asus-expertbook-b2402-matches-cover-more-models.patch
queue-6.11/thermal-intel-int340x-processor-fix-warning-during-m.patch
queue-6.11/thermal-core-reference-count-the-zone-in-thermal_zone_get_by_id.patch
queue-6.11/powercap-intel_rapl_tpmi-ignore-minor-version-change.patch
queue-6.11/powercap-intel_rapl_tpmi-fix-bogus-register-reading.patch
queue-6.11/thermal-core-free-tzp-copy-along-with-the-thermal-zone.patch
