tmakin/tegra-linux-noble
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

thermal: core: Reference count the zone in thermal_zone_get_by_id()

Browse Source 
BugLink: https://bugs.launchpad.net/bugs/2097301

commit a42a5839f400e929c489bb1b58f54596c4535167 upstream.

There are places in the thermal netlink code where nothing prevents
the thermal zone object from going away while being accessed after it
has been returned by thermal_zone_get_by_id().

To address this, make thermal_zone_get_by_id() get a reference on the
thermal zone device object to be returned with the help of get_device(),
under thermal_list_lock, and adjust all of its callers to this change
with the help of the cleanup.h infrastructure.

Fixes: 1ce50e7d40 ("thermal: core: genetlink support for events/cmd/sampling")
Cc: 6.8+ <stable@vger.kernel.org> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Link: https://patch.msgid.link/6112242.lOV4Wx5bFT@rjwysocki.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CVE-2024-50028
Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com>
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
This commit is contained in:
Rafael J. Wysocki
2024-10-03 14:25:58 +02:00
committed by Mehmet Basaran
parent 710dfb820b
commit 44303170c3
3 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/thermal/thermal_core.c
+1
View File
@@ -625,6 +625,7 @@ struct thermal_zone_device *thermal_zone_get_by_id(int id)
mutex_lock(&thermal_list_lock);
list_for_each_entry(tz, &thermal_tz_list, node) {
if (tz->id == id) {
get_device(&tz->device);
match = tz;
break;
}
drivers/thermal/thermal_core.h
+3
View File
@@ -57,6 +57,9 @@ int for_each_thermal_governor(int (*cb)(struct thermal_governor *, void *),
struct thermal_zone_device *thermal_zone_get_by_id(int id);
DEFINE_CLASS(thermal_zone_get_by_id, struct thermal_zone_device *,
if (_T) put_device(&_T->device), thermal_zone_get_by_id(id), int id)
struct thermal_attr {
struct device_attribute attr;
char name[THERMAL_NAME_LENGTH];
drivers/thermal/thermal_netlink.c
+3 -6
View File
@@ -446,7 +446,6 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p)
{
struct sk_buff *msg = p->msg;
const struct thermal_trip *trip;
struct thermal_zone_device *tz;
struct nlattr *start_trip;
int id;
@@ -455,7 +454,7 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p)
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
tz = thermal_zone_get_by_id(id);
CLASS(thermal_zone_get_by_id, tz)(id);
if (!tz)
return -EINVAL;
@@ -489,7 +488,6 @@ out_cancel_nest:
static int thermal_genl_cmd_tz_get_temp(struct param *p)
{
struct sk_buff *msg = p->msg;
struct thermal_zone_device *tz;
int temp, ret, id;
if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
@@ -497,7 +495,7 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p)
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
tz = thermal_zone_get_by_id(id);
CLASS(thermal_zone_get_by_id, tz)(id);
if (!tz)
return -EINVAL;
@@ -515,7 +513,6 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p)
static int thermal_genl_cmd_tz_get_gov(struct param *p)
{
struct sk_buff *msg = p->msg;
struct thermal_zone_device *tz;
int id, ret = 0;
if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID])
@@ -523,7 +520,7 @@ static int thermal_genl_cmd_tz_get_gov(struct param *p)
id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]);
tz = thermal_zone_get_by_id(id);
CLASS(thermal_zone_get_by_id, tz)(id);
if (!tz)
return -EINVAL;