Re: [PATCH] thermal/of: Fix double free of params during unregistration

[Daniel Lezcano]

Hi Mark,

On 23/07/2023 01:26, Mark Brown wrote:
> Unlike the other data structures provided during registration the
> thermal core takes a copy of the thermal_zone_params provided to it and
> stores that copy in the thermal_zone_device, taking care to free it on
> unregistration.  This is done because the parameters will be modified at
> runtime.
>
> Unfortunately the thermal_of code assumes that the params structure it
> provides will be used throughout the lifetime of the device and since
> the params are dynamically allocated based on the bindings it attempts
> to free it on unregistration.  This results in not only leaking the
> original params but also double freeing the copy the core made, leading
> to memory corruption.
>
> Fix this by instead freeing the params parsed from the DT during
> registration.
>
> This issue causing instability on systems where thermal zones are
> unregistered, especially visble on those systems where some zones
> provided by a device have no trip points such as Allwinner systems.
> For example with current mainline an arm64 defconfig is unbootable on
> Pine64 Plus and LibreTech Tritium is massively unstable.  These issues
> have been there for a while and have been made more prominent by recent
> memory management changes.
>
> Fixes: 3fd6d6e2b4e80 ("thermal/of: Rework the thermal device tree initialization")
> Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx

I think this issue has been fixed by:

https://lore.kernel.org/all/20230708112720.2897484-2-a.fatoum@xxxxxxxxxxxxxx/

Rafael ? Did you pick it up ?


--
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog