Re: [PATCH v1 03/14] thermal/core: Make thermal_cooling_device_init_complete() non static

sashiko-bot
2026-04-19T18:43:15Z

Sashiko AI review found 1 potential issue(s):
- [High] Missing initialization for devres-managed cooling devices leading to resource leaks and potential use-after-free.
--

commit 45d7db5abc941e576e78d521933630ff7a08efc5
Author: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com>

thermal/core: Make thermal_cooling_device_init_complete() non static

This commit splits thermal_cooling_device_init_complete() out from
__thermal_cooling_device_register() so it can be called explicitly by
specific implementations like the thermal OF code.

> diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
> index 8a70768b46ddd..35cf170f3fa1c 100644
> --- a/drivers/thermal/thermal_core.c
> +++ b/drivers/thermal/thermal_core.c

[ ... ]

> @@ -1127,8 +1127,6 @@ __thermal_cooling_device_register(struct device_node *np,
> if (current_state <= cdev->max_state)
> thermal_debug_cdev_add(cdev, current_state);
>
> - thermal_cooling_device_init_complete(cdev);
> -
> return cdev;

[ ... ]

> diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
> index 398157e740fc7..35d542aac7f8d 100644
> --- a/drivers/thermal/thermal_of.c
> +++ b/drivers/thermal/thermal_of.c

[ ... ]

> @@ -531,7 +531,15 @@ thermal_of_cooling_device_register(struct device_node *np,
> const char *type, void *devdata,
> const struct thermal_cooling_device_ops *ops)
> {
> - return __thermal_cooling_device_register(np, type, devdata, ops);
> + struct thermal_cooling_device *cdev;
> +
> + cdev = __thermal_cooling_device_register(np, type, devdata, ops);
> + if (IS_ERR(cdev))
> + return cdev;
> +
> + thermal_cooling_device_init_complete(cdev);
> +
> + return cdev;
> }
> EXPORT_SYMBOL_GPL(thermal_of_cooling_device_register);

Does this miss updating devm_thermal_of_cooling_device_register() which also
calls __thermal_cooling_device_register() directly?

Because thermal_cooling_device_init_complete() was removed from the inner
helper, cooling devices registered via the devm variant will no longer be
added to the global thermal_cdev_list, and consequently won't bind to any
thermal zones.

Furthermore, when devres calls thermal_cooling_device_release() on driver
unload, thermal_cooling_device_unregister() aborts early because the
device is missing from thermal_cdev_list:

void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev)
{
...
if (!thermal_cooling_device_present(cdev))
return;
...
}

This skips device_unregister(), permanently leaking the memory and IDA,
and leaving dangling sysfs entries which can trigger a use-after-free if
accessed later.

While this is fixed later in the patch series by commit "thermal/of: Move
the node pointer assignation in the OF code file", will this temporary
breakage impact bisectability?

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260419182203.4083985-1-daniel.lezcano@oss.qualcomm.com?part=3