Re: [PATCH] thermal/core: update cooling device during thermal zone unregistration

From: Dan Carpenter
Date: Wed Mar 22 2023 - 04:07:23 EST


Hi Zhang,

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url: https://github.com/intel-lab-lkp/linux/commits/Zhang-Rui/thermal-core-update-cooling-device-during-thermal-zone-unregistration/20230321-234754
base: https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git thermal
patch link: https://lore.kernel.org/r/20230321154627.17787-1-rui.zhang%40intel.com
patch subject: [PATCH] thermal/core: update cooling device during thermal zone unregistration
config: i386-randconfig-m021 (https://download.01.org/0day-ci/archive/20230322/202303221159.6cdRxcUo-lkp@xxxxxxxxx/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Reported-by: Dan Carpenter <error27@xxxxxxxxx>
| Link: https://lore.kernel.org/r/202303221159.6cdRxcUo-lkp@xxxxxxxxx/

smatch warnings:
drivers/thermal/thermal_core.c:1436 thermal_zone_device_unregister() warn: iterator used outside loop: 'ti'

vim +/ti +1436 drivers/thermal/thermal_core.c

203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1402 void thermal_zone_device_unregister(struct thermal_zone_device *tz)
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1403 {
a5f785ce608caf drivers/thermal/thermal_core.c Dmitry Osipenko 2020-08-18 1404 int i, tz_id;
7e8ee1e9d7561f drivers/thermal/thermal_sys.c Durgadoss R 2012-09-18 1405 const struct thermal_zone_params *tzp;
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1406 struct thermal_cooling_device *cdev;
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1407 struct thermal_zone_device *pos = NULL;
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1408 struct thermal_instance *ti;
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1409
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1410 if (!tz)
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1411 return;
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1412
7e8ee1e9d7561f drivers/thermal/thermal_sys.c Durgadoss R 2012-09-18 1413 tzp = tz->tzp;
a5f785ce608caf drivers/thermal/thermal_core.c Dmitry Osipenko 2020-08-18 1414 tz_id = tz->id;
7e8ee1e9d7561f drivers/thermal/thermal_sys.c Durgadoss R 2012-09-18 1415
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1416 mutex_lock(&thermal_list_lock);
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1417 list_for_each_entry(pos, &thermal_tz_list, node)
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1418 if (pos == tz)
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1419 break;
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1420 if (pos != tz) {
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1421 /* thermal zone device not found */
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1422 mutex_unlock(&thermal_list_lock);
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1423 return;
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1424 }
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1425 list_del(&tz->node);
7e8ee1e9d7561f drivers/thermal/thermal_sys.c Durgadoss R 2012-09-18 1426
7e8ee1e9d7561f drivers/thermal/thermal_sys.c Durgadoss R 2012-09-18 1427 /* Unbind all cdevs associated with 'this' thermal zone */
7e8ee1e9d7561f drivers/thermal/thermal_sys.c Durgadoss R 2012-09-18 1428 list_for_each_entry(cdev, &thermal_cdev_list, node) {
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1429 mutex_lock(&tz->lock);
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1430 list_for_each_entry(ti, &tz->thermal_instances, tz_node) {
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1431 if (ti->cdev == cdev)
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1432 break;
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1433 }
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1434
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1435 /* The cooling device is not used by current thermal zone */
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 @1436 if (ti->cdev != cdev) {

Here we are testing to see if the loop exited by hitting the break. If
the condition is != then "ti" is not a valid pointer and it's kind of an
out of bounds access. I used to fix these with:

- if (ti->cdev != cdev) {
+ if (list_entry_is_head(ti, &tz->thermal_instances, tz_node)) {

But these days we just prefer using a found variable:

found = false;
list_for_each_entry(ti, &tz->thermal_instances, tz_node) {
if (ti->cdev == cdev) {
found = true;
break;
}
}
if (!found) {

55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1437 mutex_unlock(&tz->lock);
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1438 continue;
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1439 }
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1440 mutex_unlock(&tz->lock);
55a1117eebc62b drivers/thermal/thermal_core.c Zhang Rui 2023-03-21 1441
7e8ee1e9d7561f drivers/thermal/thermal_sys.c Durgadoss R 2012-09-18 1442 if (tz->ops->unbind) {
203d3d4aa48233 drivers/thermal/thermal.c Zhang Rui 2008-01-17 1443 tz->ops->unbind(tz, cdev);

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests