Commit 23dcd749 authored by Hans de Goede's avatar Hans de Goede
Browse files

platform/x86: think-lmi: Move kfree(setting->possible_values) to tlmi_attr_setting_release() 



We must not free the possible_values string before we have called
sysfs_remove_group(kobj, &tlmi_attr_group) otherwise there is a race
where a sysfs read of possible_values could reference the free-ed
memory.

Move the kfree(setting->possible_values) together with the free of the
actual tlmi_attr_setting struct to avoid this race.

Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
parent 0fdf10e5

drivers/platform/x86/think-lmi.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -626,6 +626,7 @@ static void tlmi_attr_setting_release(struct kobject *kobj) 
{

{

	struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);

	struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);





	kfree(setting->possible_values);

	kfree(setting);

	kfree(setting);

}

}
@@ -654,7 +655,6 @@ static void tlmi_release_attr(void) 
	/* Attribute structures */

	/* Attribute structures */

	for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {

	for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {

		if (tlmi_priv.setting[i]) {

		if (tlmi_priv.setting[i]) {

			kfree(tlmi_priv.setting[i]->possible_values);

			sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);

			sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);

			kobject_put(&tlmi_priv.setting[i]->kobj);

			kobject_put(&tlmi_priv.setting[i]->kobj);

		}

		}