diff mbox series

thermal/drivers/cpuidle_cooling: Fix use after error

Message ID 20210319202522.891061-1-daniel.lezcano@linaro.org (mailing list archive)
State New
Delegated to: Daniel Lezcano
Headers show
Series thermal/drivers/cpuidle_cooling: Fix use after error | expand

Commit Message

Daniel Lezcano March 19, 2021, 8:25 p.m. UTC
When the function successfully finishes it logs an information about
the registration of the cooling device and use its name to build the
message. Unfortunately it was freed right before:

drivers/thermal/cpuidle_cooling.c:218 __cpuidle_cooling_register()
	warn: 'name' was already freed.

Fix this by freeing after the message happened.

Fixes: 6fd1b186d900 ("thermal/drivers/cpuidle_cooling: Use device name instead of auto-numbering")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
---
 drivers/thermal/cpuidle_cooling.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

Comments

Viresh Kumar March 22, 2021, 3:29 a.m. UTC | #1
On 19-03-21, 21:25, Daniel Lezcano wrote:
> When the function successfully finishes it logs an information about
> the registration of the cooling device and use its name to build the
> message. Unfortunately it was freed right before:
> 
> drivers/thermal/cpuidle_cooling.c:218 __cpuidle_cooling_register()
> 	warn: 'name' was already freed.
> 
> Fix this by freeing after the message happened.
> 
> Fixes: 6fd1b186d900 ("thermal/drivers/cpuidle_cooling: Use device name instead of auto-numbering")

Why not merge this with the Fixes patch itself since it isn't there in Linus's
tree yet ?

Or is your branch strictly immutable ?
Daniel Lezcano March 22, 2021, 8:08 a.m. UTC | #2
On 22/03/2021 04:29, Viresh Kumar wrote:
> On 19-03-21, 21:25, Daniel Lezcano wrote:
>> When the function successfully finishes it logs an information about
>> the registration of the cooling device and use its name to build the
>> message. Unfortunately it was freed right before:
>>
>> drivers/thermal/cpuidle_cooling.c:218 __cpuidle_cooling_register()
>> 	warn: 'name' was already freed.
>>
>> Fix this by freeing after the message happened.
>>
>> Fixes: 6fd1b186d900 ("thermal/drivers/cpuidle_cooling: Use device name instead of auto-numbering")
> 
> Why not merge this with the Fixes patch itself since it isn't there in Linus's
> tree yet ?
> 
> Or is your branch strictly immutable ?

Hi Viresh;

The changes follow the path:

testing -> linux-next -> next

The branch next is never rebased. The patch above reached it. This is
notified by the thermal-bot [1].

  -- Daniel

[1]
https://lore.kernel.org/linux-pm/20210314111333.16551-3-daniel.lezcano@linaro.org/T/#ma257519efc70ee60faca47dbd458b05de5449bf8
Viresh Kumar March 22, 2021, 8:12 a.m. UTC | #3
On 22-03-21, 09:08, Daniel Lezcano wrote:
> On 22/03/2021 04:29, Viresh Kumar wrote:
> > On 19-03-21, 21:25, Daniel Lezcano wrote:
> >> When the function successfully finishes it logs an information about
> >> the registration of the cooling device and use its name to build the
> >> message. Unfortunately it was freed right before:
> >>
> >> drivers/thermal/cpuidle_cooling.c:218 __cpuidle_cooling_register()
> >> 	warn: 'name' was already freed.
> >>
> >> Fix this by freeing after the message happened.
> >>
> >> Fixes: 6fd1b186d900 ("thermal/drivers/cpuidle_cooling: Use device name instead of auto-numbering")
> > 
> > Why not merge this with the Fixes patch itself since it isn't there in Linus's
> > tree yet ?
> > 
> > Or is your branch strictly immutable ?
> 
> Hi Viresh;
> 
> The changes follow the path:
> 
> testing -> linux-next -> next
> 
> The branch next is never rebased. The patch above reached it. This is
> notified by the thermal-bot [1].

Ahh, I see.

Here you go :)

Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
diff mbox series

Patch

diff --git a/drivers/thermal/cpuidle_cooling.c b/drivers/thermal/cpuidle_cooling.c
index f32976163bad..4f41102e8b16 100644
--- a/drivers/thermal/cpuidle_cooling.c
+++ b/drivers/thermal/cpuidle_cooling.c
@@ -208,18 +208,20 @@  static int __cpuidle_cooling_register(struct device_node *np,
 
 	cdev = thermal_of_cooling_device_register(np, name, idle_cdev,
 						  &cpuidle_cooling_ops);
-	kfree(name);
-
 	if (IS_ERR(cdev)) {
 		ret = PTR_ERR(cdev);
-		goto out_unregister;
+		goto out_kfree_name;
 	}
 
 	pr_debug("%s: Idle injection set with idle duration=%u, latency=%u\n",
 		 name, idle_duration_us, latency_us);
 
+	kfree(name);
+
 	return 0;
 
+out_kfree_name:
+	kfree(name);
 out_unregister:
 	idle_inject_unregister(ii_dev);
 out_kfree: