From: Hans de Goede <hdegoede@redhat.com>
Date: Mon, 28 Jun 2021 09:36:00 +0000 (+0200)
Subject: platform/x86: think-lmi: Move kfree(setting->possible_values) to tlmi_attr_setting_re... 
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=23dcd7497c227a16acdda5e44f141fdc1e660f94;p=linux.git

platform/x86: think-lmi: Move kfree(setting->possible_values) to tlmi_attr_setting_release()

We must not free the possible_values string before we have called
sysfs_remove_group(kobj, &tlmi_attr_group) otherwise there is a race
where a sysfs read of possible_values could reference the free-ed
memory.

Move the kfree(setting->possible_values) together with the free of the
actual tlmi_attr_setting struct to avoid this race.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
---

diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index 4cab341a35389..3671b5d206132 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -626,6 +626,7 @@ static void tlmi_attr_setting_release(struct kobject *kobj)
 {
 	struct tlmi_attr_setting *setting = to_tlmi_attr_setting(kobj);
 
+	kfree(setting->possible_values);
 	kfree(setting);
 }
 
@@ -654,7 +655,6 @@ static void tlmi_release_attr(void)
 	/* Attribute structures */
 	for (i = 0; i < TLMI_SETTINGS_COUNT; i++) {
 		if (tlmi_priv.setting[i]) {
-			kfree(tlmi_priv.setting[i]->possible_values);
 			sysfs_remove_group(&tlmi_priv.setting[i]->kobj, &tlmi_attr_group);
 			kobject_put(&tlmi_priv.setting[i]->kobj);
 		}