From 95638f1f05ced75a82e83f610cd01b636d2a21b1 Mon Sep 17 00:00:00 2001 From: Guenter Roeck Date: Sat, 31 Oct 2026 03:08:32 +0000 Subject: [PATCH] hwmon: (coretemp) Set nr_cores only after core_data allocation succeeds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In init_temp_data(), pdata->nr_cores is populated from topology_num_cores_per_package() before allocating pdata->core_data. If that allocation fails, init_temp_data() returns NULL with pdata->core_data still NULL and pdata->nr_cores set to a positive value. coretemp_add_core() logs the error without failing coretemp_cpu_online(), so the CPU still comes online with pdata->hwmon_dev registered. When the CPU is later taken offline (or the module is unloaded), coretemp_cpu_offline() calls get_temp_data(pd, cpu), which loops up to pdata->nr_cores and dereferences the NULL pdata->core_data pointer. Store the core count in a local variable and assign pdata->nr_cores only after pdata->core_data is allocated, preserving the invariant that pdata->nr_cores is zero whenever pdata->core_data is NULL. Reported-by: Sashiko Fixes: 1a793caf6f69 ("hwmon: (coretemp) Use dynamic allocated memory for core temp_data") Cc: stable@vger.kernel.org Tested-by: Asaf Nuri Bertizlioğlu Signed-off-by: Guenter Roeck --- drivers/hwmon/coretemp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c index eb74ecd12310..7fced0e2abeb 100644 --- a/drivers/hwmon/coretemp.c +++ b/drivers/hwmon/coretemp.c @@ -491,11 +491,12 @@ init_temp_data(struct platform_data *pdata, unsigned int cpu, int pkg_flag) struct temp_data *tdata; if (!pdata->core_data) { - pdata->nr_cores = topology_num_cores_per_package(); - pdata->core_data = kzalloc_objs(struct temp_data *, - pdata->nr_cores); + int nr_cores = topology_num_cores_per_package(); + + pdata->core_data = kzalloc_objs(struct temp_data *, nr_cores); if (!pdata->core_data) return NULL; + pdata->nr_cores = nr_cores; } tdata = kzalloc_obj(struct temp_data);