Re: [PATCH v6 2/2] thermal/drivers/imx: Add calibration offset support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free due to devm-managed IRQ outliving thermal zone unregistered in remove
--

--- Patch [2]: [PATCH v6 2/2] thermal/drivers/imx: Add calibration offset support ---
commit 9fae0662c1aea3575b716baf0cd588bdc25d2359
Author: Haoning CHENG <Haoning.CHENG@cn.bosch.com>

thermal/drivers/imx: Add calibration offset support

Some boards need a small per-design correction to align the reported CPU
temperature with board-level measurements. Read the optional
fsl,temp-calibration-offset-millicelsius property from DT and apply it to
the i.MX6/6SX/7D calibration formulas.

> diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
> index 5aaacbc534786..5e3cff69aced7 100644
> --- a/drivers/thermal/imx_thermal.c
> +++ b/drivers/thermal/imx_thermal.c

[ ... ]

> @@ -629,6 +635,10 @@ static int imx_thermal_probe(struct platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, data);
>  
> +	of_property_read_s32(dev->of_node,
> +			     "fsl,temp-calibration-offset-millicelsius",
> +			     &data->calibration_offset);
> +

[Severity: High]
This is a pre-existing issue, but does the devm-managed IRQ lifecycle create
a use-after-free condition during driver unbind?

When the driver unbinds, imx_thermal_remove() explicitly calls
thermal_zone_device_unregister(data->tz), which frees the thermal zone
object.

However, because the IRQ was registered with devm_request_threaded_irq()
in imx_thermal_probe(), it remains active until the driver core runs
devres cleanup after the remove function returns.

If a thermal alarm interrupt fires during this window, the handler will
execute:

imx_thermal_alarm_irq_thread()
    ...
    thermal_zone_device_update(data->tz, THERMAL_EVENT_UNSPECIFIED);

Could this dereference the already-freed data->tz?

>  	if (of_property_present(dev->of_node, "nvmem-cells")) {
>  		ret = imx_init_from_nvmem_cells(pdev);
>  		if (ret)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-b4-symana21-11221-imx-thermal-support-upstream-6-18-v6-0-88a378faeca5@cn.bosch.com?part=2