mirros/rockchip-kernel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "thermal/core: fix a UAF bug in __thermal_cooling_device_register()"

Browse Source 
This reverts commit b132abaa65 which is
commit 0a5c26712f upstream.

It breaks the Android kernel ABI and is not needed for Android devices,
so it is safe to revert for now.  If it is determined that it is needed
in the future, it can be brought back in an abi-preserving way.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibaaab9a23fa0cbb5b11204cd6dc59b29215ee8a1
This commit is contained in:
Greg Kroah-Hartman
2022-07-28 09:36:50 +02:00
parent 2dc56158cb
commit 090d920be9
1 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/thermal/thermal_core.c
View File

@@ -1095,7 +1095,7 @@ __thermal_cooling_device_register(struct device_node *np,
{ {
struct thermal_cooling_device *cdev; struct thermal_cooling_device *cdev;
struct thermal_zone_device *pos = NULL; struct thermal_zone_device *pos = NULL;
int id, ret; int ret;
if (!ops || !ops->get_max_state || !ops->get_cur_state || if (!ops || !ops->get_max_state || !ops->get_cur_state ||
!ops->set_cur_state) !ops->set_cur_state)
@@ -1109,7 +1109,6 @@ __thermal_cooling_device_register(struct device_node *np,
if (ret < 0) if (ret < 0)
goto out_kfree_cdev; goto out_kfree_cdev;
cdev->id = ret; cdev->id = ret;
id = ret;
cdev->type = kstrdup(type ? type : "", GFP_KERNEL); cdev->type = kstrdup(type ? type : "", GFP_KERNEL);
if (!cdev->type) { if (!cdev->type) {
@@ -1151,9 +1150,8 @@ out_kfree_type:
thermal_cooling_device_destroy_sysfs(cdev); thermal_cooling_device_destroy_sysfs(cdev);
kfree(cdev->type); kfree(cdev->type);
put_device(&cdev->device); put_device(&cdev->device);
cdev = NULL;
out_ida_remove: out_ida_remove:
ida_simple_remove(&thermal_cdev_ida, id); ida_simple_remove(&thermal_cdev_ida, cdev->id);
out_kfree_cdev: out_kfree_cdev:
return ERR_PTR(ret); return ERR_PTR(ret);
} }