thermal: core: Fix use-after-free in thermal_zone_device_unregister()
authorDmitry Osipenko <digetx@gmail.com>
Mon, 17 Aug 2020 23:58:54 +0000 (02:58 +0300)
committerDaniel Lezcano <daniel.lezcano@linaro.org>
Fri, 4 Sep 2020 09:52:54 +0000 (11:52 +0200)
commita5f785ce608cafc444cdf047d1791d5ad97943ba
tree3fe4a708b1185ad6694567d3c4da4b20498a933c
parent0ffdab6f2dea9e23ec33230de24e492ff0b186d9
thermal: core: Fix use-after-free in thermal_zone_device_unregister()

The user-after-free bug in thermal_zone_device_unregister() is reported by
KASAN. It happens because struct thermal_zone_device is released during of
device_unregister() invocation, and hence the "tz" variable shouldn't be
touched by thermal_notify_tz_delete(tz->id).

Fixes: 55cdf0a283b8 ("thermal: core: Add notifications call in the framework")
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20200817235854.26816-1-digetx@gmail.com
drivers/thermal/thermal_core.c