From 732e4c8db99cb3125bd6865794ec8e3a998c4d6e Mon Sep 17 00:00:00 2001 From: "durgadoss.r@intel.com" Date: Wed, 2 Oct 2013 00:08:00 +0530 Subject: [PATCH] Thermal: Check for validity before doing kfree The thermal_release function is called whenever any device belonging to 'thermal' class unregisters. This function performs kfree(cdev) without any check. In cases where there are more device registrations other than just 'thermal_zone' and 'cooling_device' this might accidently free memory allocated them silently; and cause memory errors. This patch changes this behavior by doing kfree(cdev) only when the device pointer belongs to a real cdev i.e. cooling_device. Signed-off-by: Durgadoss R Signed-off-by: Zhang Rui --- drivers/thermal/thermal_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 4962a6aaf295..db99b334712a 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -1038,7 +1038,8 @@ static void thermal_release(struct device *dev) sizeof("thermal_zone") - 1)) { tz = to_thermal_zone(dev); kfree(tz); - } else { + } else if(!strncmp(dev_name(dev), "cooling_device", + sizeof("cooling_device") - 1)){ cdev = to_cooling_device(dev); kfree(cdev); }