Thermal: Fix oops and unlocking in thermal_sys.c

This patch fixes the following mutex and NULL pointer
problems in thermal_sys.c:

 * mutex_unlock fix in update_temperature function
 * mutex_unlock fix in bind_cdev function
 * Correct early return to continue in bind_cdev function
 * NULL check fix in bind_cdev function
 * NULL check fix in bind_tz function

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Reported-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Durgadoss R <durgadoss.r@intel.com>
Signed-off-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index a69f24c4414a..8f0f37bb2825 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -252,8 +252,8 @@ static void bind_cdev(struct thermal_cooling_device *cdev)
                 }
 
                 tzp = pos->tzp;
-                if (!tzp->tbp)
-                        return;
+                if (!tzp || !tzp->tbp)
+                        continue;
 
                 for (i = 0; i < tzp->num_tbps; i++) {
                         if (tzp->tbp[i].cdev || !tzp->tbp[i].match)
@@ -289,7 +289,7 @@ static void bind_tz(struct thermal_zone_device *tz)
                 goto exit;
         }
 
-        if (!tzp->tbp)
+        if (!tzp || !tzp->tbp)
                 goto exit;
 
         list_for_each_entry(pos, &thermal_cdev_list, node) {
@@ -387,12 +387,13 @@ static void update_temperature(struct thermal_zone_device *tz)
         ret = tz->ops->get_temp(tz, &temp);
         if (ret) {
                 pr_warn("failed to read out thermal zone %d\n", tz->id);
-                return;
+                goto exit;
         }
 
         tz->last_temperature = tz->temperature;
         tz->temperature = temp;
 
+exit:
         mutex_unlock(&tz->lock);
 }