From 732e4c8db99cb3125bd6865794ec8e3a998c4d6e Mon Sep 17 00:00:00 2001 From: "durgadoss.r@intel.com" Date: Wed, 2 Oct 2013 00:08:00 +0530 Subject: Thermal: Check for validity before doing kfree The thermal_release function is called whenever any device belonging to 'thermal' class unregisters. This function performs kfree(cdev) without any check. In cases where there are more device registrations other than just 'thermal_zone' and 'cooling_device' this might accidently free memory allocated them silently; and cause memory errors. This patch changes this behavior by doing kfree(cdev) only when the device pointer belongs to a real cdev i.e. cooling_device. Signed-off-by: Durgadoss R Signed-off-by: Zhang Rui --- drivers/thermal/thermal_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/thermal') diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 4962a6a..db99b33 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -1038,7 +1038,8 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); kfree(tz); - } else { + } else if(!strncmp(dev_name(dev), "cooling_device", + sizeof("cooling_device") - 1)){ cdev = to_cooling_device(dev); kfree(cdev); } -- cgit v1.1