Re: [PATCH v1 03/14] thermal/core: Make thermal_cooling_device_init_complete() non static

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] Missing initialization for devres-managed cooling devices leading to resource leaks and potential use-after-free.
--

commit 45d7db5abc941e576e78d521933630ff7a08efc5
Author: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com>

thermal/core: Make thermal_cooling_device_init_complete() non static
    
This commit splits thermal_cooling_device_init_complete() out from
__thermal_cooling_device_register() so it can be called explicitly by
specific implementations like the thermal OF code.

> diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
> index 8a70768b46ddd..35cf170f3fa1c 100644
> --- a/drivers/thermal/thermal_core.c
> +++ b/drivers/thermal/thermal_core.c

[ ... ]

> @@ -1127,8 +1127,6 @@ __thermal_cooling_device_register(struct device_node *np,
>  	if (current_state <= cdev->max_state)
>  		thermal_debug_cdev_add(cdev, current_state);
>  
> -	thermal_cooling_device_init_complete(cdev);
> -
>  	return cdev;

[ ... ]

> diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
> index 398157e740fc7..35d542aac7f8d 100644
> --- a/drivers/thermal/thermal_of.c
> +++ b/drivers/thermal/thermal_of.c

[ ... ]

> @@ -531,7 +531,15 @@ thermal_of_cooling_device_register(struct device_node *np,
>  				   const char *type, void *devdata,
>  				   const struct thermal_cooling_device_ops *ops)
>  {
> -	return __thermal_cooling_device_register(np, type, devdata, ops);
> +	struct thermal_cooling_device *cdev;
> +
> +	cdev = __thermal_cooling_device_register(np, type, devdata, ops);
> +	if (IS_ERR(cdev))
> +		return cdev;
> +
> +	thermal_cooling_device_init_complete(cdev);
> +
> +	return cdev;
>  }
>  EXPORT_SYMBOL_GPL(thermal_of_cooling_device_register);

Does this miss updating devm_thermal_of_cooling_device_register() which also
calls __thermal_cooling_device_register() directly?

Because thermal_cooling_device_init_complete() was removed from the inner
helper, cooling devices registered via the devm variant will no longer be
added to the global thermal_cdev_list, and consequently won't bind to any
thermal zones.

Furthermore, when devres calls thermal_cooling_device_release() on driver
unload, thermal_cooling_device_unregister() aborts early because the
device is missing from thermal_cdev_list:

void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev)
{
        ...
        if (!thermal_cooling_device_present(cdev))
                return;
        ...
}

This skips device_unregister(), permanently leaking the memory and IDA,
and leaving dangling sysfs entries which can trigger a use-after-free if
accessed later.

While this is fixed later in the patch series by commit "thermal/of: Move
the node pointer assignation in the OF code file", will this temporary
breakage impact bisectability?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260419182203.4083985-1-daniel.lezcano@oss.qualcomm.com?part=3