Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

thermal/drivers/cpuidle_cooling: Fix use after error

When the function successfully finishes it logs an information about
the registration of the cooling device and use its name to build the
message. Unfortunately it was freed right before:

drivers/thermal/cpuidle_cooling.c:218 __cpuidle_cooling_register()
warn: 'name' was already freed.

Fix this by freeing after the message happened.

Fixes: 6fd1b186d900 ("thermal/drivers/cpuidle_cooling: Use device name instead of auto-numbering")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Link: https://lore.kernel.org/r/20210319202522.891061-1-daniel.lezcano@linaro.org

+5 -3
+5 -3
drivers/thermal/cpuidle_cooling.c
··· 208 208 209 209 cdev = thermal_of_cooling_device_register(np, name, idle_cdev, 210 210 &cpuidle_cooling_ops); 211 - kfree(name); 212 - 213 211 if (IS_ERR(cdev)) { 214 212 ret = PTR_ERR(cdev); 215 - goto out_unregister; 213 + goto out_kfree_name; 216 214 } 217 215 218 216 pr_debug("%s: Idle injection set with idle duration=%u, latency=%u\n", 219 217 name, idle_duration_us, latency_us); 220 218 219 + kfree(name); 220 + 221 221 return 0; 222 222 223 + out_kfree_name: 224 + kfree(name); 223 225 out_unregister: 224 226 idle_inject_unregister(ii_dev); 225 227 out_kfree: