mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Thermal control fixes for 6.9-rc7 

Fix a memory leak and a few locking issues (that may cause the kernel
 to crash in principle if all goes wrong) in the thermal debug code
 introduced during the 6.8 development cycle.
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAmYzct8SHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxVDsP/0HaZuSX87xjpKPE3+oxg7JyCNUhsnFu
 OeoJv4bj1TcDd6KV/g2yr9gXzAXFA6Eef0f5QfcORMzzCAyux8Rb6tLP9lWIxdNK
 BAGcwC9Moe7QgKEuBaktRtTZd/BPPcNoln32eKRUCIY8OGm6sxucMWmiwdSwZ+mm
 POUOerRKM3YouUDdPCn+HeRcLm5HFMOrFOaan/WT1X1ENVNJyIAR9MWtObPghqqr
 vz5COoGHbCwGW8u/Lvm+Ipm2Cyr/w3n7Ro+C/KMPwoP+YVPlYpXPqRF77+OXGw/0
 7cg+/VA8gWxASRn2xmktxYgUJfmJexkHFjAEpkASeJCir3Lka5Qo7lxU2LNiESBA
 2eC9HFfIk02EHTj76grqQRvQLvuI2pDR369IcWDA64u57e67b+vp/njjnBFg5rGi
 RbCqLJBRxuC65iLzOZb+KBL8zLtYtHScHYWf9BlU1aat9W1ZZeJUq7NkvC2oWXqc
 uuezM564gD3Ahh5vsRq+1nlP8rGFBaFs7NbFzVTI/18OHNf7Z6hHWEq6+cit9v3q
 rqwDdNPmWwukjIoPJc6cfsy70yRUskkkvYQKpafK9rBMDrz1T9Sqlm9wRWhLljcF
 HWoNwjtSYStYNyioe4tl2i0BX3lx/8K6UuDP7LBE1WE+9Xsxk41whT0u7KdZVZjj
 KWXqpdF2Iz3Q
 =bEdF
 -----END PGP SIGNATURE-----

Merge tag 'thermal-6.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull thermal control fixes from Rafael Wysocki:
 "Fix a memory leak and a few locking issues (that may cause the kernel
  to crash in principle if all goes wrong) in the thermal debug code
  introduced during the 6.8 development cycle"

* tag 'thermal-6.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal/debugfs: Prevent use-after-free from occurring after cdev removal
  thermal/debugfs: Fix two locking issues with thermal zone debug
  thermal/debugfs: Free all thermal zone debug memory on zone removal
This commit is contained in:
Linus Torvalds 2024-05-02 09:01:27 -07:00
parent 545c494465 d351eb0ab0
commit 6aed7b97fc
1 changed files with 45 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
drivers/thermal/thermal_debugfs.c
View File

@ -139,11 +139,13 @@ struct tz_episode {
* we keep track of the current position in the history array.
*
* @tz_episodes: a list of thermal mitigation episodes
* @tz: thermal zone this object belongs to
* @trips_crossed: an array of trip points crossed by id
* @nr_trips: the number of trip points currently being crossed
*/
struct tz_debugfs {
struct list_head tz_episodes;
struct thermal_zone_device *tz;
int *trips_crossed;
int nr_trips;
};
@ -503,15 +505,23 @@ void thermal_debug_cdev_add(struct thermal_cooling_device *cdev)
*/
void thermal_debug_cdev_remove(struct thermal_cooling_device *cdev)
{
struct thermal_debugfs *thermal_dbg = cdev->debugfs;
struct thermal_debugfs *thermal_dbg;
if (!thermal_dbg)
mutex_lock(&cdev->lock);
thermal_dbg = cdev->debugfs;
if (!thermal_dbg) {
mutex_unlock(&cdev->lock);
return;
}
cdev->debugfs = NULL;
mutex_unlock(&cdev->lock);
mutex_lock(&thermal_dbg->lock);
thermal_debugfs_cdev_clear(&thermal_dbg->cdev_dbg);
cdev->debugfs = NULL;
mutex_unlock(&thermal_dbg->lock);
@ -716,8 +726,7 @@ out:
static void *tze_seq_start(struct seq_file *s, loff_t *pos)
{
struct thermal_zone_device *tz = s->private;
struct thermal_debugfs *thermal_dbg = tz->debugfs;
struct thermal_debugfs *thermal_dbg = s->private;
struct tz_debugfs *tz_dbg = &thermal_dbg->tz_dbg;
mutex_lock(&thermal_dbg->lock);
@ -727,8 +736,7 @@ static void *tze_seq_start(struct seq_file *s, loff_t *pos)
static void *tze_seq_next(struct seq_file *s, void *v, loff_t *pos)
{
struct thermal_zone_device *tz = s->private;
struct thermal_debugfs *thermal_dbg = tz->debugfs;
struct thermal_debugfs *thermal_dbg = s->private;
struct tz_debugfs *tz_dbg = &thermal_dbg->tz_dbg;
return seq_list_next(v, &tz_dbg->tz_episodes, pos);
@ -736,15 +744,15 @@ static void *tze_seq_next(struct seq_file *s, void *v, loff_t *pos)
static void tze_seq_stop(struct seq_file *s, void *v)
{
struct thermal_zone_device *tz = s->private;
struct thermal_debugfs *thermal_dbg = tz->debugfs;
struct thermal_debugfs *thermal_dbg = s->private;
mutex_unlock(&thermal_dbg->lock);
}
static int tze_seq_show(struct seq_file *s, void *v)
{
struct thermal_zone_device *tz = s->private;
struct thermal_debugfs *thermal_dbg = s->private;
struct thermal_zone_device *tz = thermal_dbg->tz_dbg.tz;
struct thermal_trip *trip;
struct tz_episode *tze;
const char *type;
@ -810,6 +818,8 @@ void thermal_debug_tz_add(struct thermal_zone_device *tz)
tz_dbg = &thermal_dbg->tz_dbg;
tz_dbg->tz = tz;
tz_dbg->trips_crossed = kzalloc(sizeof(int) * tz->num_trips, GFP_KERNEL);
if (!tz_dbg->trips_crossed) {
thermal_debugfs_remove_id(thermal_dbg);
@ -818,23 +828,44 @@ void thermal_debug_tz_add(struct thermal_zone_device *tz)
INIT_LIST_HEAD(&tz_dbg->tz_episodes);
debugfs_create_file("mitigations", 0400, thermal_dbg->d_top, tz, &tze_fops);
debugfs_create_file("mitigations", 0400, thermal_dbg->d_top,
thermal_dbg, &tze_fops);
tz->debugfs = thermal_dbg;
}
void thermal_debug_tz_remove(struct thermal_zone_device *tz)
{
struct thermal_debugfs *thermal_dbg = tz->debugfs;
struct thermal_debugfs *thermal_dbg;
struct tz_episode *tze, *tmp;
struct tz_debugfs *tz_dbg;
int *trips_crossed;
if (!thermal_dbg)
mutex_lock(&tz->lock);
thermal_dbg = tz->debugfs;
if (!thermal_dbg) {
mutex_unlock(&tz->lock);
return;
}
tz->debugfs = NULL;
mutex_unlock(&tz->lock);
tz_dbg = &thermal_dbg->tz_dbg;
mutex_lock(&thermal_dbg->lock);
tz->debugfs = NULL;
trips_crossed = tz_dbg->trips_crossed;
list_for_each_entry_safe(tze, tmp, &tz_dbg->tz_episodes, node) {
list_del(&tze->node);
kfree(tze);
}
mutex_unlock(&thermal_dbg->lock);
thermal_debugfs_remove_id(thermal_dbg);
kfree(trips_crossed);
}