Received-SPF: pass (google.com: domain of linux-kernel+bounces-76379-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Precedence: bulk
MIME-Version: 1.0
References: <4551531.LvFx2qVVIh@kreacher> <2262393.iZASKD2KPV@kreacher>
 <ffa37950-d850-44e2-a33e-837466238d6d@linaro.org> <CAJZ5v0hqCbxChYmvADZJAFiuS1yPnRmj6ZZJfD032tnLB7ZZAA@mail.gmail.com>
 <ccf63280-bad1-4450-bf36-44cd1dcb69b2@linaro.org>
In-Reply-To: <ccf63280-bad1-4450-bf36-44cd1dcb69b2@linaro.org>
From: "Rafael J. Wysocki" <rafael@kernel.org>
Date: Thu, 22 Feb 2024 12:03:34 +0100
Message-ID: <CAJZ5v0hju2ZQsqBYMcs+_TDB+7aH=_Lo7BwqJ=WX1VMkHK38jA@mail.gmail.com>
Subject: Re: [PATCH v2 4/6] thermal: core: Store zone ops in struct thermal_zone_device
To: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>, "Rafael J. Wysocki" <rjw@rjwysocki.net>, 
	Linux PM <linux-pm@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>, 
	Linux ACPI <linux-acpi@vger.kernel.org>, Lukasz Luba <lukasz.luba@arm.com>, 
	Zhang Rui <rui.zhang@intel.com>, 
	Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>, 
	Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>, Shawn Guo <shawnguo@kernel.org>, 
	Sascha Hauer <s.hauer@pengutronix.de>, Pengutronix Kernel Team <kernel@pengutronix.de>, 
	Fabio Estevam <festevam@gmail.com>, NXP Linux Team <linux-imx@nxp.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Feb 22, 2024 at 11:58=E2=80=AFAM Daniel Lezcano
<daniel.lezcano@linaro.org> wrote:
>
> On 22/02/2024 11:52, Rafael J. Wysocki wrote:
> > On Thu, Feb 22, 2024 at 11:47=E2=80=AFAM Daniel Lezcano
> > <daniel.lezcano@linaro.org> wrote:
> >>
> >> On 14/02/2024 13:45, Rafael J. Wysocki wrote:
> >>> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> >>>
> >>> The current code requires thermal zone creators to pass pointers to
> >>> writable ops structures to thermal_zone_device_register_with_trips()
> >>> which needs to modify the target struct thermal_zone_device_ops objec=
t
> >>> if the "critical" operation in it is NULL.
> >>>
> >>> Moreover, the callers of thermal_zone_device_register_with_trips() ar=
e
> >>> required to hold on to the struct thermal_zone_device_ops object pass=
ed
> >>> to it until the given thermal zone is unregistered.
> >>>
> >>> Both of these requirements are quite inconvenient, so modify struct
> >>> thermal_zone_device to contain struct thermal_zone_device_ops as fiel=
d and
> >>> make thermal_zone_device_register_with_trips() copy the contents of t=
he
> >>> struct thermal_zone_device_ops passed to it via a pointer (which can =
be
> >>> const now) to that field.
> >>>
> >>> Also adjust the code using thermal zone ops accordingly and modify
> >>> thermal_of_zone_register() to use a local ops variable during
> >>> thermal zone registration so ops do not need to be freed in
> >>> thermal_of_zone_unregister() any more.
> >>
> >> [ ... ]
> >>
> >>>    static void thermal_of_zone_unregister(struct thermal_zone_device =
*tz)
> >>>    {
> >>>        struct thermal_trip *trips =3D tz->trips;
> >>> -     struct thermal_zone_device_ops *ops =3D tz->ops;
> >>>
> >>>        thermal_zone_device_disable(tz);
> >>>        thermal_zone_device_unregister(tz);
> >>>        kfree(trips);
> >>
> >> Not related to the current patch but with patch 1/6. Freeing the trip
> >> points here will lead to a double free given it is already freed from
> >> thermal_zone_device_unregister() after the changes introduces in patch
> >> 1, right ?
> >
> > No, patch [1/6] doesn't free the caller-supplied ops, just copies them
> > into the local instance.  Attempting to free a static ops would not be
> > a good idea, for example.
>
> I'm referring to the trip points not the ops.

Ah, sorry for the confusion.

> The patch 1 does:
>
> tz =3D kzalloc(struct_size(tz, trips, num_trips), GFP_KERNEL);
>
> Then the last line of thermal_zone_device_unregister() does:
>
> kfree(tz);
>
> That includes the trip points in the flexible array.

Right.

> Now in thermal_of_zone_unregister(), we do:
>
> trips =3D tz->trips;

I missed this.

> thermal_zone_device_unregister(tz);
> kfree(trips);
>
> Hence double kfree, right?

Indeed, so patch [1/6] is missing a thermal_of change to stop freeing
trips separately.  Let me send an update of just that patch.