From 380c17f3dc544b2e44948d5fbe7eea0d39d2bd3f Mon Sep 17 00:00:00 2001 From: Naman Padhiar Date: Sun, 16 Aug 2020 12:43:05 +0530 Subject: [PATCH] icnss2: Fix null-pointer derefrence while thermal unregister Structure pointer added in list was not deleted properly. Delete list in proper sequence and free pointer. Change-Id: I9a5deb0801ec7366d0be7049e8771016a3bbdf44 Signed-off-by: Naman Padhiar --- drivers/soc/qcom/icnss2/main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/soc/qcom/icnss2/main.c b/drivers/soc/qcom/icnss2/main.c index a58e2cfc532d..5777a1941b61 100644 --- a/drivers/soc/qcom/icnss2/main.c +++ b/drivers/soc/qcom/icnss2/main.c @@ -1887,7 +1887,7 @@ int icnss_thermal_cdev_register(struct device *dev, unsigned long max_state, struct device_node *dev_node; int ret = 0; - icnss_tcdev = devm_kzalloc(dev, sizeof(*icnss_tcdev), GFP_KERNEL); + icnss_tcdev = kzalloc(sizeof(*icnss_tcdev), GFP_KERNEL); if (!icnss_tcdev) return -ENOMEM; @@ -1934,7 +1934,10 @@ void icnss_thermal_cdev_unregister(struct device *dev, int tcdev_id) struct icnss_priv *priv = dev_get_drvdata(dev); struct icnss_thermal_cdev *icnss_tcdev = NULL; - list_for_each_entry(icnss_tcdev, &priv->icnss_tcdev_list, tcdev_list) { + while (!list_empty(&priv->icnss_tcdev_list)) { + icnss_tcdev = list_first_entry(&priv->icnss_tcdev_list, + struct icnss_thermal_cdev, + tcdev_list); thermal_cooling_device_unregister(icnss_tcdev->tcdev); list_del(&icnss_tcdev->tcdev_list); kfree(icnss_tcdev);