linux-stable/drivers/thermal
Rafael J. Wysocki d351eb0ab0 thermal/debugfs: Prevent use-after-free from occurring after cdev removal
Since thermal_debug_cdev_remove() does not run under cdev->lock, it can
run in parallel with thermal_debug_cdev_state_update() and it may free
the struct thermal_debugfs object used by the latter after it has been
checked against NULL.

If that happens, thermal_debug_cdev_state_update() will access memory
that has been freed already causing the kernel to crash.

Address this by using cdev->lock in thermal_debug_cdev_remove() around
the cdev->debugfs value check (in case the same cdev is removed at the
same time in two different threads) and its reset to NULL.

Fixes: 755113d767 ("thermal/debugfs: Add thermal cooling device debugfs information")
Cc :6.8+ <stable@vger.kernel.org> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
2024-04-26 14:57:50 +02:00
..
broadcom thermal: ns: Convert to platform remove callback returning void 2023-09-29 12:34:16 +02:00
intel Thermal control updates for 6.9-rc1 2024-03-13 12:03:57 -07:00
mediatek thermal/drivers/mediatek: Fix control buffer enablement on MT7896 2024-03-11 17:14:46 +01:00
qcom Thermal control updates for 6.7-rc1 2023-10-31 15:28:37 -10:00
samsung thermal/drivers/exynos: Use set_trips ops 2024-01-02 09:33:19 +01:00
st thermal: Drop spaces before TABs 2024-03-11 17:14:46 +01:00
tegra thermal: tegra-bpmp: Convert to platform remove callback returning void 2023-10-02 14:24:13 +02:00
ti-soc-thermal thermal: ti-bandgap: Convert to platform remove callback returning void 2023-10-02 14:24:15 +02:00
amlogic_thermal.c thermal: amlogic: Use DEFINE_SIMPLE_DEV_PM_OPS for PM functions 2024-01-02 09:33:18 +01:00
armada_thermal.c thermal: armada: Convert to platform remove callback returning void 2023-09-29 12:34:16 +02:00
cpufreq_cooling.c drivers/thermal/cpufreq_cooling: Use new Energy Model interface 2024-02-08 15:00:31 +01:00
cpuidle_cooling.c thermal: cpuidle_cooling: fix kernel-doc warning and a spello 2023-12-21 12:05:48 +01:00
da9062-thermal.c thermal: core: Eliminate writable trip points masks 2024-02-27 12:04:38 +01:00
db8500_thermal.c thermal/drivers/db8500: Remove redundant of_match_ptr() 2023-08-16 12:09:19 +02:00
devfreq_cooling.c thermal: devfreq_cooling: Fix perf state when calculate dfc res_util 2024-03-27 16:27:39 +01:00
dove_thermal.c thermal: dove: Convert to platform remove callback returning void 2023-09-29 12:34:16 +02:00
gov_bang_bang.c thermal: gov_bang_bang: Fix possible cooling device state ping-pong 2024-01-29 15:37:56 +01:00
gov_fair_share.c thermal: gov_fair_share: Fix dependency on trip points ordering 2024-01-29 15:37:56 +01:00
gov_power_allocator.c thermal: gov_power_allocator: Allow binding without trip points 2024-04-03 16:32:15 +02:00
gov_step_wise.c thermal: core: Pass trip pointer to governor throttle callback 2023-10-20 19:26:37 +02:00
gov_user_space.c thermal: core: Pass trip pointer to governor throttle callback 2023-10-20 19:26:37 +02:00
hisi_thermal.c thermal: hisi: Convert to platform remove callback returning void 2023-09-29 12:34:16 +02:00
imx8mm_thermal.c thermal/drivers/imx8mm_thermal: Fix function pointer declaration by adding identifier name 2023-10-15 23:40:09 +02:00
imx_sc_thermal.c thermal: Explicitly include correct DT includes 2023-07-31 20:03:42 +02:00
imx_thermal.c thermal: core: Eliminate writable trip points masks 2024-02-27 12:04:38 +01:00
k3_bandgap.c thermal: k3_bandgap: Convert to platform remove callback returning void 2023-09-29 12:34:17 +02:00
k3_j72xx_bandgap.c thermal: k3_j72xx_bandgap: Convert to platform remove callback returning void 2023-09-29 12:34:17 +02:00
Kconfig thermal: Get rid of CONFIG_THERMAL_WRITABLE_TRIPS 2024-02-23 18:24:48 +01:00
khadas_mcu_fan.c
kirkwood_thermal.c thermal: kirkwood: Convert to platform remove callback returning void 2023-09-29 12:34:17 +02:00
loongson2_thermal.c thermal: loongson2: Replace of_device.h with explicit includes 2024-01-19 08:08:53 -06:00
Makefile thermal: Drop spaces before TABs 2024-03-11 17:14:46 +01:00
max77620_thermal.c thermal/drivers/max77620: Remove duplicate error message 2023-10-15 23:40:10 +02:00
qoriq_thermal.c thermal/drivers/qoriq: Fix getting tmu range 2024-03-11 17:14:46 +01:00
rcar_gen3_thermal.c thermal/drivers/rcar_gen3: Add support for R-Car V4M 2024-03-11 17:14:46 +01:00
rcar_thermal.c thermal: core: Eliminate writable trip points masks 2024-02-27 12:04:38 +01:00
rockchip_thermal.c thermal: rockchip: Convert to platform remove callback returning void 2023-10-02 14:23:30 +02:00
rzg2l_thermal.c thermal: rzg2l: Convert to platform remove callback returning void 2023-10-02 14:23:51 +02:00
spear_thermal.c thermal: spear: Convert to platform remove callback returning void 2023-10-02 14:24:06 +02:00
sprd_thermal.c thermal: sprd: Convert to platform remove callback returning void 2023-10-02 14:24:08 +02:00
sun8i_thermal.c thermal/drivers/sun8i: Don't fail probe due to zone registration failure 2024-03-11 17:14:46 +01:00
thermal-generic-adc.c thermal/drivers/generic-adc: Removed unneeded call to platform_set_drvdata() 2023-08-16 12:36:21 +02:00
thermal_core.c thermal: core: Remove excess empty line from a comment 2024-03-05 13:17:33 +01:00
thermal_core.h thermal: core: Add flags to struct thermal_trip 2024-02-27 12:02:50 +01:00
thermal_debugfs.c thermal/debugfs: Prevent use-after-free from occurring after cdev removal 2024-04-26 14:57:50 +02:00
thermal_debugfs.h thermal/debugfs: Add thermal debugfs information for mitigation episodes 2024-01-12 15:37:49 +01:00
thermal_helpers.c thermal: core: Store zone ops in struct thermal_zone_device 2024-02-23 18:24:48 +01:00
thermal_hwmon.c thermal: core: Store zone ops in struct thermal_zone_device 2024-02-23 18:24:48 +01:00
thermal_hwmon.h thermal/hwmon: Use the right device for devm_thermal_add_hwmon_sysfs() 2023-03-03 20:45:02 +01:00
thermal_mmio.c thermal/core: Use the thermal zone 'devdata' accessor in thermal located drivers 2023-03-03 20:45:02 +01:00
thermal_netlink.c thermal: netlink: Rework notify API for cooling devices 2024-01-12 15:38:23 +01:00
thermal_netlink.h thermal: netlink: Rework notify API for cooling devices 2024-01-12 15:38:23 +01:00
thermal_of.c thermal/of: Assume polling-delay(-passive) 0 when absent 2024-03-11 17:14:46 +01:00
thermal_sysfs.c thermal: core: remove unnecessary check in trip_point_hyst_store() 2024-03-06 13:26:25 +01:00
thermal_trace.h thermal/core: Relocate the traces definition in thermal directory 2023-04-01 20:51:45 +02:00
thermal_trace_ipa.h thermal: gov_power_allocator: Change trace functions 2023-12-29 18:01:00 +01:00
thermal_trip.c Revert "thermal: core: Don't update trip points inside the hysteresis range" 2024-03-26 13:18:13 +01:00
uniphier_thermal.c thermal: uniphier: Convert to platform remove callback returning void 2023-10-02 14:24:17 +02:00