thermal/core: fix a UAF bug in __thermal_cooling_device_register()

[platform/kernel/linux-rpi.git] / drivers / thermal / thermal_core.c

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index d094ebb..30134f4 100644 (file)
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -887,7 +887,7 @@ __thermal_cooling_device_register(struct device_node *np,
 {
        struct thermal_cooling_device *cdev;
        struct thermal_zone_device *pos = NULL;
-       int ret;
+       int id, ret;
 
        if (!ops || !ops->get_max_state || !ops->get_cur_state ||
            !ops->set_cur_state)
@@ -901,6 +901,7 @@ __thermal_cooling_device_register(struct device_node *np,
        if (ret < 0)
                goto out_kfree_cdev;
        cdev->id = ret;
+       id = ret;
 
        ret = dev_set_name(&cdev->device, "cooling_device%d", cdev->id);
        if (ret)
@@ -944,8 +945,9 @@ __thermal_cooling_device_register(struct device_node *np,
 out_kfree_type:
        kfree(cdev->type);
        put_device(&cdev->device);
+       cdev = NULL;
 out_ida_remove:
-       ida_simple_remove(&thermal_cdev_ida, cdev->id);
+       ida_simple_remove(&thermal_cdev_ida, id);
 out_kfree_cdev:
        kfree(cdev);
        return ERR_PTR(ret);