Re: [PATCH 05/18] thermal/drivers/imx: Remove redundant dev_err()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The thermal zone device `data->tz` is dereferenced after it is freed if the temperature alarm interrupt fires during module removal.
--

--- Patch [5]: [PATCH 05/18] thermal/drivers/imx: Remove redundant dev_err() ---
commit 27d7703d9347749240647995387a1e21fab7887b
Author: Pan Chuang <panchuang@vivo.com>

thermal/drivers/imx: Remove redundant dev_err()
    
The devm_request_threaded_irq() now automatically logs detailed error
messages on failure. This eliminates the need for driver-specific
dev_err() calls that previously printed generic messages.

> diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
> index 5aaacbc534786..416d89c6287ad 100644
> --- a/drivers/thermal/imx_thermal.c
> +++ b/drivers/thermal/imx_thermal.c
> @@ -732,10 +732,8 @@ static int imx_thermal_probe(struct platform_device *pdev)
>  	ret = devm_request_threaded_irq(dev, data->irq,
>  			imx_thermal_alarm_irq, imx_thermal_alarm_irq_thread,
>  			0, "imx_thermal", data);
> -	if (ret < 0) {
> -		dev_err(dev, "failed to request alarm irq: %d\n", ret);
> +	if (ret < 0)
>  		goto thermal_zone_unregister;

[Severity: High]
This is a pre-existing issue, but could this lead to a use-after-free if the
temperature alarm interrupt fires during module removal?

Because the alarm IRQ is requested using devm_request_threaded_irq(), its
lifetime is tied to the device unbind phase via devres, meaning it is only
freed after the remove function finishes. However, in imx_thermal_remove(),
the thermal zone device is unregistered and freed:

drivers/thermal/imx_thermal.c:imx_thermal_remove() {
	...
	thermal_zone_device_unregister(data->tz);
	...
}

Since the devm resources are cleaned up only after remove() returns, the IRQ
remains active while and after data->tz is freed. If the interrupt fires
during this window, wouldn't the threaded handler dereference the freed
data->tz?

drivers/thermal/imx_thermal.c:imx_thermal_alarm_irq_thread() {
	...
	thermal_zone_device_update(data->tz, THERMAL_EVENT_UNSPECIFIED);
	...
}

> -	}
>  
>  	pm_runtime_put(data->dev);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709023048.599150-1-panchuang@vivo.com?part=5