PM / devfreq: fix use after free in devfreq_remove_device

In devfreq_remove_device, calling _remove_devfreq will also free devfreq. Don't dereference devfreq->governor->no_central_polling after _remove_devfreq. Signed-off-by: Axel Lin <[email protected]> Acked-by: MyungJoo Ham <[email protected]> Signed-off-by: Rafael J. Wysocki <[email protected]>
cbmeeks · Nov 14, 2011 · 9f3bdd4 · 9f3bdd4
1 parent bc9f544
commit 9f3bdd4
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
@@ -418,10 +418,14 @@ struct devfreq *devfreq_add_device(struct device *dev,
  */
 int devfreq_remove_device(struct devfreq *devfreq)
 {
+	bool central_polling;
+
 	if (!devfreq)
 		return -EINVAL;
 
-	if (!devfreq->governor->no_central_polling) {
+	central_polling = !devfreq->governor->no_central_polling;
+
+	if (central_polling) {
 		mutex_lock(&devfreq_list_lock);
 		while (wait_remove_device == devfreq) {
 			mutex_unlock(&devfreq_list_lock);
@@ -433,7 +437,7 @@ int devfreq_remove_device(struct devfreq *devfreq)
 	mutex_lock(&devfreq->lock);
 	_remove_devfreq(devfreq, false); /* it unlocks devfreq->lock */
 
-	if (!devfreq->governor->no_central_polling)
+	if (central_polling)
 		mutex_unlock(&devfreq_list_lock);
 
 	return 0;