[PATCH 00/18] thermal/drivers: Remove redundant error messages on IRQ request failure

[PATCH 00/18] thermal/drivers: Remove redundant error messages on IRQ request failure

[Pan Chuang]

Commit 55b48e23f5c4b6f5ca9b7ab09599b17dcf501c10 ("genirq/devres: Add
error handling in devm_request_*_irq()") added automatic error
logging to devm_request_threaded_irq() and
devm_request_any_context_irq() via the new devm_request_result() 
helper, which prints device name, IRQ number, handler functions, and
error code on failure.

Since devm_request_irq() is a static inline wrapper around
devm_request_threaded_irq(), it also benefits from this automatic
logging.

Remove the now-redundant dev_err() and dev_err_probe() calls in
thermal drivers that follow these devm_request_*_irq() functions, as
the core now provides more detailed diagnostic information on failure.

Pan Chuang (18):
  thermal/drivers/airoha: Remove redundant dev_err()
  thermal/drivers/armada: Remove redundant dev_err()
  thermal/drivers/db8500: Remove redundant dev_err()
  thermal/drivers/hisi: Remove redundant dev_err()
  thermal/drivers/imx: Remove redundant dev_err()
  thermal/drivers/loongson2: Remove redundant dev_err_probe()
  thermal/drivers/max77620: Remove redundant dev_err()
  thermal/drivers/rockchip: Remove redundant dev_err_probe()
  thermal/drivers/brcmstb_thermal: Remove redundant dev_err_probe()
  thermal: intel: int340x: Remove redundant dev_err()
  thermal/drivers/intel/bxt_pmic: Remove redundant dev_err()
  thermal/drivers/mediatek/lvts_thermal: Remove redundant dev_err()
  thermal/drivers/qcom: Remove redundant dev_err()
  thermal/drivers/renesas: Remove redundant dev_err()
  thermal/drivers/exynos: Remove redundant dev_err()
  thermal/drivers/st: Remove redundant dev_err()
  thermal/drivers/tegra: Remove redundant dev_err() and dev_err_probe()
  thermal/drivers/imx91: Remove redundant dev_err_probe()

 drivers/thermal/airoha_thermal.c                          | 4 +---
 drivers/thermal/armada_thermal.c                          | 5 +----
 drivers/thermal/broadcom/brcmstb_thermal.c                | 3 +--
 drivers/thermal/db8500_thermal.c                          | 8 ++------
 drivers/thermal/hisi_thermal.c                            | 4 +---
 drivers/thermal/imx91_thermal.c                           | 2 +-
 drivers/thermal/imx_thermal.c                             | 4 +---
 .../intel/int340x_thermal/processor_thermal_device_pci.c  | 8 ++------
 drivers/thermal/intel/intel_bxt_pmic_thermal.c            | 4 +---
 drivers/thermal/loongson2_thermal.c                       | 2 +-
 drivers/thermal/max77620_thermal.c                        | 8 ++------
 drivers/thermal/mediatek/lvts_thermal.c                   | 2 +-
 drivers/thermal/qcom/lmh.c                                | 1 -
 drivers/thermal/qcom/tsens.c                              | 5 +----
 drivers/thermal/renesas/rcar_thermal.c                    | 4 +---
 drivers/thermal/renesas/rzg3e_thermal.c                   | 4 +---
 drivers/thermal/rockchip_thermal.c                        | 3 +--
 drivers/thermal/samsung/exynos_tmu.c                      | 4 +---
 drivers/thermal/st/st_thermal_memmap.c                    | 4 +---
 drivers/thermal/st/stm_thermal.c                          | 5 +----
 drivers/thermal/tegra/soctherm.c                          | 8 ++------
 drivers/thermal/tegra/tegra30-tsensor.c                   | 3 +--
 22 files changed, 25 insertions(+), 70 deletions(-)

-- 
2.34.1

[PATCH 05/18] thermal/drivers/imx: Remove redundant dev_err()

[Pan Chuang]

The devm_request_threaded_irq() now automatically logs detailed error
messages on failure. This eliminates the need for driver-specific
dev_err() calls that previously printed generic messages.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/thermal/imx_thermal.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index 5aaacbc53478..416d89c6287a 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -732,10 +732,8 @@ static int imx_thermal_probe(struct platform_device *pdev)
 	ret = devm_request_threaded_irq(dev, data->irq,
 			imx_thermal_alarm_irq, imx_thermal_alarm_irq_thread,
 			0, "imx_thermal", data);
-	if (ret < 0) {
-		dev_err(dev, "failed to request alarm irq: %d\n", ret);
+	if (ret < 0)
 		goto thermal_zone_unregister;
-	}
 
 	pm_runtime_put(data->dev);
 
-- 
2.34.1

[PATCH 18/18] thermal/drivers/imx91: Remove redundant dev_err_probe()

[Pan Chuang]

The devm_request_threaded_irq() now automatically logs detailed error
messages on failure. This eliminates the need for driver-specific
dev_err_probe() calls that previously printed generic messages.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/thermal/imx91_thermal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thermal/imx91_thermal.c b/drivers/thermal/imx91_thermal.c
index 25915bb702be..274eee303142 100644
--- a/drivers/thermal/imx91_thermal.c
+++ b/drivers/thermal/imx91_thermal.c
@@ -331,7 +331,7 @@ static int imx91_tmu_probe(struct platform_device *pdev)
 					IRQF_ONESHOT, "imx91_thermal", tmu);
 
 	if (ret < 0)
-		return dev_err_probe(dev, ret, "failed to request alarm irq\n");
+		return ret;
 
 	pm_runtime_put(dev);
 
-- 
2.34.1

Re: [PATCH 05/18] thermal/drivers/imx: Remove redundant dev_err()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The thermal zone device `data->tz` is dereferenced after it is freed if the temperature alarm interrupt fires during module removal.
--

--- Patch [5]: [PATCH 05/18] thermal/drivers/imx: Remove redundant dev_err() ---
commit 27d7703d9347749240647995387a1e21fab7887b
Author: Pan Chuang <panchuang@vivo.com>

thermal/drivers/imx: Remove redundant dev_err()
    
The devm_request_threaded_irq() now automatically logs detailed error
messages on failure. This eliminates the need for driver-specific
dev_err() calls that previously printed generic messages.

> diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
> index 5aaacbc534786..416d89c6287ad 100644
> --- a/drivers/thermal/imx_thermal.c
> +++ b/drivers/thermal/imx_thermal.c
> @@ -732,10 +732,8 @@ static int imx_thermal_probe(struct platform_device *pdev)
>  	ret = devm_request_threaded_irq(dev, data->irq,
>  			imx_thermal_alarm_irq, imx_thermal_alarm_irq_thread,
>  			0, "imx_thermal", data);
> -	if (ret < 0) {
> -		dev_err(dev, "failed to request alarm irq: %d\n", ret);
> +	if (ret < 0)
>  		goto thermal_zone_unregister;

[Severity: High]
This is a pre-existing issue, but could this lead to a use-after-free if the
temperature alarm interrupt fires during module removal?

Because the alarm IRQ is requested using devm_request_threaded_irq(), its
lifetime is tied to the device unbind phase via devres, meaning it is only
freed after the remove function finishes. However, in imx_thermal_remove(),
the thermal zone device is unregistered and freed:

drivers/thermal/imx_thermal.c:imx_thermal_remove() {
	...
	thermal_zone_device_unregister(data->tz);
	...
}

Since the devm resources are cleaned up only after remove() returns, the IRQ
remains active while and after data->tz is freed. If the interrupt fires
during this window, wouldn't the threaded handler dereference the freed
data->tz?

drivers/thermal/imx_thermal.c:imx_thermal_alarm_irq_thread() {
	...
	thermal_zone_device_update(data->tz, THERMAL_EVENT_UNSPECIFIED);
	...
}

> -	}
>  
>  	pm_runtime_put(data->dev);
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709023048.599150-1-panchuang@vivo.com?part=5

Re: [PATCH 18/18] thermal/drivers/imx91: Remove redundant dev_err_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Driver unbind causes a fatal hardware access and double-disable of the TMU clock if the device is suspended.
- [Critical] Hardware is accessed before asynchronous PM resume completes, and PM usage count leaks on error.
- [Critical] Reading the temperature via sysfs when the thermal zone is disabled causes a kernel crash due to unclocked hardware access.
- [High] PM runtime usage counter is permanently leaked on error paths in `imx91_tmu_probe()`.
- [High] The IRQ handler accesses hardware registers without verifying the device is runtime-active, risking a bus error.
--

--- Patch [18]: [PATCH 18/18] thermal/drivers/imx91: Remove redundant dev_err_probe() ---
commit 49fc5692bf44b8731b85be1cb5d7f3ecfbbc5b8d
Author: Pan Chuang <panchuang@vivo.com>

thermal/drivers/imx91: Remove redundant dev_err_probe()

The devm_request_threaded_irq() now automatically logs detailed error
messages on failure. This eliminates the need for driver-specific
dev_err_probe() calls that previously printed generic messages.

> diff --git a/drivers/thermal/imx91_thermal.c b/drivers/thermal/imx91_thermal.c
> index 25915bb702bea..274eee3031429 100644
> --- a/drivers/thermal/imx91_thermal.c
> +++ b/drivers/thermal/imx91_thermal.c
> @@ -331,7 +331,7 @@ static int imx91_tmu_probe(struct platform_device *pdev)
>  					IRQF_ONESHOT, "imx91_thermal", tmu);
>  
>  	if (ret < 0)
> -		return dev_err_probe(dev, ret, "failed to request alarm irq\n");
> +		return ret;

[Severity: High]
This isn't a bug introduced by this patch, but does this error path permanently
leak the PM runtime usage counter?

If an error occurs during probe (e.g., in devm_thermal_of_zone_register(),
platform_get_irq(), or devm_request_threaded_irq()), the function returns
without dropping the usage counter.

The usage counter incremented by pm_runtime_get_noresume(dev) earlier in
probe is never decremented, preventing the device and its parent power
domain from entering low-power states.

>  
>  	pm_runtime_put(dev);
>  

[Severity: Critical]
This is a pre-existing issue, but does driver unbind cause a fatal hardware
access if the device is suspended?

drivers/thermal/imx91_thermal.c:imx91_tmu_action_remove() {
	struct imx91_tmu *tmu = data;

	/* disable tmu */
	imx91_tmu_enable(tmu, false);
}

During driver unbind, devres executes cleanup actions in reverse order:
pm_runtime_disable() (which does not wake the device), followed by
imx91_tmu_action_remove(), and finally clk_disable_unprepare() from
devm_clk_get_enabled().

If the device is suspended (its normal idle state), its clock is already
disabled.

Calling imx91_tmu_enable() writes to hardware registers without a clock, which
can cause a fatal bus fault that crashes the system.

Will the devres clock cleanup also underflow the clock reference count?

[Severity: High]
This is a pre-existing issue, but does the IRQ handler access hardware
registers without verifying the device is runtime-active?

drivers/thermal/imx91_thermal.c:imx91_tmu_alarm_irq() {
	struct imx91_tmu *tmu = data;
	u32 val;

	val = readl_relaxed(tmu->base + IMX91_TMU_STAT0);
...
}

The interrupt handler reads IMX91_TMU_STAT0 unconditionally. The driver does
not disable the IRQ during imx91_tmu_runtime_suspend().

If a spurious interrupt fires, or if an interrupt is raised mid-flight
concurrently with the device entering runtime suspend, the handler will
access unclocked hardware, resulting in a fatal bus fault.

Should the handler use pm_runtime_get_if_active() to verify the device is
powered before touching registers?

[Severity: Critical]
This is a pre-existing issue, but is hardware accessed here before the
asynchronous PM resume completes?

drivers/thermal/imx91_thermal.c:imx91_tmu_change_mode() {
...
	if (mode == THERMAL_DEVICE_ENABLED) {
		ret = pm_runtime_get(tmu->dev);
		if (ret < 0)
			return ret;

		writel_relaxed(IMX91_TMU_CTRL0_THR1_IE | IMX91_TMU_CTRL0_THR1_MASK,
			       tmu->base + IMX91_TMU_CTRL0 + REG_CLR);
...
}

The driver uses pm_runtime_get(), which queues an asynchronous resume and
returns 0 if the device was suspended.

The driver then immediately accesses hardware registers, racing ahead of the
actual clock enablement in imx91_tmu_runtime_resume(). Accessing unclocked
hardware causes a fatal bus fault.

Additionally, if pm_runtime_get() returns a negative error code, the driver
returns directly without dropping the usage counter, causing a PM leak.

Should pm_runtime_resume_and_get() be used instead?

[Severity: Critical]
This is a pre-existing issue, but does reading the temperature via sysfs when
the thermal zone is disabled cause a kernel crash?

drivers/thermal/imx91_thermal.c:imx91_tmu_get_temp() {
	struct imx91_tmu *tmu = thermal_zone_device_priv(tz);
	s16 data;

	/* DATA0 is 16bit signed number */
	data = readw_relaxed(tmu->base + IMX91_TMU_DATA0);
...
}

When the thermal zone is disabled via sysfs, imx91_tmu_change_mode() calls
pm_runtime_put(), suspending the device and disabling its clock.

The thermal core does not block sysfs reads of the temp attribute while the
zone is disabled.

When any user reads the temperature, imx91_tmu_get_temp() directly accesses
the IMX91_TMU_DATA0 register without ensuring the device is resumed.

Accessing unclocked registers triggers a bus fault, allowing an unprivileged
user to cause a Denial of Service.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709023048.599150-1-panchuang@vivo.com?part=18

Re: [PATCH 05/18] thermal/drivers/imx: Remove redundant dev_err()

[Frank Li]

On Thu, Jul 09, 2026 at 10:30:08AM +0800, Pan Chuang wrote:
>
> The devm_request_threaded_irq() now automatically logs detailed error
> messages on failure. This eliminates the need for driver-specific
> dev_err() calls that previously printed generic messages.
>
> Signed-off-by: Pan Chuang <panchuang@vivo.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/thermal/imx_thermal.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
> index 5aaacbc53478..416d89c6287a 100644
> --- a/drivers/thermal/imx_thermal.c
> +++ b/drivers/thermal/imx_thermal.c
> @@ -732,10 +732,8 @@ static int imx_thermal_probe(struct platform_device *pdev)
>         ret = devm_request_threaded_irq(dev, data->irq,
>                         imx_thermal_alarm_irq, imx_thermal_alarm_irq_thread,
>                         0, "imx_thermal", data);
> -       if (ret < 0) {
> -               dev_err(dev, "failed to request alarm irq: %d\n", ret);
> +       if (ret < 0)
>                 goto thermal_zone_unregister;
> -       }
>
>         pm_runtime_put(data->dev);
>
> --
> 2.34.1
>
>

Re: [PATCH 18/18] thermal/drivers/imx91: Remove redundant dev_err_probe()

[Frank Li]

On Thu, Jul 09, 2026 at 10:30:21AM +0800, Pan Chuang wrote:
>
> The devm_request_threaded_irq() now automatically logs detailed error
> messages on failure. This eliminates the need for driver-specific
> dev_err_probe() calls that previously printed generic messages.
>
> Signed-off-by: Pan Chuang <panchuang@vivo.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/thermal/imx91_thermal.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/thermal/imx91_thermal.c b/drivers/thermal/imx91_thermal.c
> index 25915bb702be..274eee303142 100644
> --- a/drivers/thermal/imx91_thermal.c
> +++ b/drivers/thermal/imx91_thermal.c
> @@ -331,7 +331,7 @@ static int imx91_tmu_probe(struct platform_device *pdev)
>                                         IRQF_ONESHOT, "imx91_thermal", tmu);
>
>         if (ret < 0)
> -               return dev_err_probe(dev, ret, "failed to request alarm irq\n");
> +               return ret;
>
>         pm_runtime_put(dev);
>
> --
> 2.34.1
>
>

Re: [PATCH 00/18] thermal/drivers: Remove redundant error messages on IRQ request failure

[Krzysztof Kozlowski]

On 09/07/2026 04:30, Pan Chuang wrote:
> Commit 55b48e23f5c4b6f5ca9b7ab09599b17dcf501c10 ("genirq/devres: Add
> error handling in devm_request_*_irq()") added automatic error
> logging to devm_request_threaded_irq() and
> devm_request_any_context_irq() via the new devm_request_result() 
> helper, which prints device name, IRQ number, handler functions, and
> error code on failure.
> 
> Since devm_request_irq() is a static inline wrapper around
> devm_request_threaded_irq(), it also benefits from this automatic
> logging.
> 
> Remove the now-redundant dev_err() and dev_err_probe() calls in
> thermal drivers that follow these devm_request_*_irq() functions, as
> the core now provides more detailed diagnostic information on failure.
> 
> Pan Chuang (18):
>   thermal/drivers/airoha: Remove redundant dev_err()
>   thermal/drivers/armada: Remove redundant dev_err()
>   thermal/drivers/db8500: Remove redundant dev_err()

all of these 18 are just one commit, no?

Best regards,
Krzysztof

Re: [PATCH 00/18] thermal/drivers: Remove redundant error messages on IRQ request failure

[Wolfram Sang]

> all of these 18 are just one commit, no?

I think so, too.