From: Dan Carpenter dan.carpenter@linaro.org
stable inclusion from stable-v6.6.11 commit 17f449600a98a18709e7f1c85546523d07480b79 bugzilla: https://gitee.com/openeuler/kernel/issues/I99TJK
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit 4b27d5c420335dad7aea1aa6e799fe1d05c63b7e ]
The acpi_thermal_unregister_thermal_zone() is paired with acpi_thermal_register_thermal_zone() so it should mirror it. It should clean up all the resources that the register function allocated and leave the stuff that was allocated elsewhere.
Unfortunately, it doesn't call thermal_zone_device_disable(). Also it calls kfree(tz->trip_table) when it shouldn't. That was allocated in acpi_thermal_add(). Putting the kfree() here leads to a double free in the acpi_thermal_add() clean up function.
Likewise, the acpi_thermal_remove() should mirror acpi_thermal_add() so it should have an explicit kfree(tz->trip_table) as well.
Fixes: ec23c1c462de ("ACPI: thermal: Use trip point table to register thermal zones") Signed-off-by: Dan Carpenter dan.carpenter@linaro.org Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com Signed-off-by: Sasha Levin sashal@kernel.org Signed-off-by: ZhangPeng zhangpeng362@huawei.com --- drivers/acpi/thermal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c index 312730f8272e..8263508415a8 100644 --- a/drivers/acpi/thermal.c +++ b/drivers/acpi/thermal.c @@ -778,9 +778,9 @@ static int acpi_thermal_register_thermal_zone(struct acpi_thermal *tz)
static void acpi_thermal_unregister_thermal_zone(struct acpi_thermal *tz) { + thermal_zone_device_disable(tz->thermal_zone); acpi_thermal_zone_sysfs_remove(tz); thermal_zone_device_unregister(tz->thermal_zone); - kfree(tz->trip_table); tz->thermal_zone = NULL; }
@@ -985,7 +985,7 @@ static void acpi_thermal_remove(struct acpi_device *device)
flush_workqueue(acpi_thermal_pm_queue); acpi_thermal_unregister_thermal_zone(tz); - + kfree(tz->trip_table); kfree(tz); }