This is a note to let you know that I've just added the patch titled
thermal: core: Free tzp copy along with the thermal zone
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
thermal-core-free-tzp-copy-along-with-the-thermal-zo.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 8e9ca18dc4ca285c1afba8e9bce91504a56f252e
Author: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx>
Date: Thu Oct 3 14:27:28 2024 +0200
thermal: core: Free tzp copy along with the thermal zone
[ Upstream commit 827a07525c099f54d3b15110408824541ec66b3c ]
The object pointed to by tz->tzp may still be accessed after being
freed in thermal_zone_device_unregister(), so move the freeing of it
to the point after the removal completion has been completed at which
it cannot be accessed any more.
Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure")
Cc: 6.8+ <stable@xxxxxxxxxxxxxxx> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@xxxxxxxxx>
Reviewed-by: Lukasz Luba <lukasz.luba@xxxxxxx>
Link: https://patch.msgid.link/4623516.LvFx2qVVIh@xxxxxxxxxxxxx
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 69b89a71f44eb..d7ac7eef680e1 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1484,14 +1484,12 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
ida_destroy(&tz->ida);
device_del(&tz->device);
-
- kfree(tz->tzp);
-
put_device(&tz->device);
thermal_notify_tz_delete(tz_id);
wait_for_completion(&tz->removal);
+ kfree(tz->tzp);
kfree(tz);
}
EXPORT_SYMBOL_GPL(thermal_zone_device_unregister);
