From d35f29ed9d11ccc4f9b957871d14726f4451a4ad Mon Sep 17 00:00:00 2001 From: Guenter Roeck Date: Thu, 10 Nov 2022 07:24:52 -0800 Subject: [PATCH] thermal/core: Destroy thermal zone device mutex in release function Accesses to thermal zones, and with it the thermal zone device mutex, are still possible after the thermal zone device has been unregistered. For example, thermal_zone_get_temp() can be called from temp_show() in thermal_sysfs.c if the sysfs attribute was opened before the thermal device was unregistered. Move the call to mutex_destroy from thermal_zone_device_unregister() to thermal_release() to ensure that it is only destroyed after it is guaranteed to be no longer accessed. Signed-off-by: Guenter Roeck Signed-off-by: Rafael J. Wysocki --- drivers/thermal/thermal_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index e0ca631ac4c8..b31d32476672 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -754,6 +754,7 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); thermal_zone_destroy_device_groups(tz); + mutex_destroy(&tz->lock); kfree(tz); } else if (!strncmp(dev_name(dev), "cooling_device", sizeof("cooling_device") - 1)) { @@ -1390,7 +1391,6 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz) thermal_remove_hwmon_sysfs(tz); ida_free(&thermal_tz_ida, tz->id); ida_destroy(&tz->ida); - mutex_destroy(&tz->lock); device_unregister(&tz->device); thermal_notify_tz_delete(tz_id);