[PATCH] thermal/drivers/rcar: add error checking in probe()

[PATCH] thermal/drivers/rcar: add error checking in probe()

[Dan Carpenter]

The thermal_zone_device_register_with_trips() can fail for a number of
reasons, including allocation failures.  Check for error pointers to
avoid an error pointer dereference.

Fixes: 9d617949d490 ("thermal/drivers/renesas: Group all renesas thermal drivers together")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
 drivers/thermal/renesas/rcar_thermal.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/thermal/renesas/rcar_thermal.c b/drivers/thermal/renesas/rcar_thermal.c
index 6e5dcac5d47a..71f836fbc698 100644
--- a/drivers/thermal/renesas/rcar_thermal.c
+++ b/drivers/thermal/renesas/rcar_thermal.c
@@ -492,6 +492,11 @@ static int rcar_thermal_probe(struct platform_device *pdev)
 				"rcar_thermal", trips, ARRAY_SIZE(trips), priv,
 						&rcar_thermal_zone_ops, NULL, 0,
 						idle);
+			if (IS_ERR(priv->zone)) {
+				ret = PTR_ERR(priv->zone);
+				priv->zone = NULL;
+				goto error_unregister;
+			}
 
 			ret = thermal_zone_device_enable(priv->zone);
 			if (ret) {
-- 
2.53.0

Re: [PATCH] thermal/drivers/rcar: add error checking in probe()

[Geert Uytterhoeven]

Hi Dan,

Thanks for your patch!

On Tue, 23 Jun 2026 at 09:49, Dan Carpenter <error27@gmail.com> wrote:
> The thermal_zone_device_register_with_trips() can fail for a number of
> reasons, including allocation failures.  Check for error pointers to
> avoid an error pointer dereference.
>
> Fixes: 9d617949d490 ("thermal/drivers/renesas: Group all renesas thermal drivers together")

This is not the commit you are looking for...

Fixes: bbcf90c0646ac797 ("thermal: Explicitly enable non-changing
thermal zone devices")

> Signed-off-by: Dan Carpenter <error27@gmail.com>

> --- a/drivers/thermal/renesas/rcar_thermal.c
> +++ b/drivers/thermal/renesas/rcar_thermal.c
> @@ -492,6 +492,11 @@ static int rcar_thermal_probe(struct platform_device *pdev)
>                                 "rcar_thermal", trips, ARRAY_SIZE(trips), priv,
>                                                 &rcar_thermal_zone_ops, NULL, 0,
>                                                 idle);
> +                       if (IS_ERR(priv->zone)) {
> +                               ret = PTR_ERR(priv->zone);
> +                               priv->zone = NULL;
> +                               goto error_unregister;
> +                       }

This check is already present below (out of context), so it would be good
to avoid duplicating it.

>
>                         ret = thermal_zone_device_enable(priv->zone);
>                         if (ret) {

The issue is that this call was added before the error checking is done.
So this should be moved below instead (to the else branch of the next
chip->use_of_thermal test?).

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Re: [PATCH] thermal/drivers/rcar: add error checking in probe()

[Dan Carpenter]

Yeah, thanks Geert.  You're right.  I'll resend.

regards,
dan carpenter

Re: [PATCH] thermal/drivers/rcar: add error checking in probe()

[Niklas Söderlund]

Hi Dan,

Thanks for your work.

On 2026-06-23 10:49:29 +0300, Dan Carpenter wrote:
> The thermal_zone_device_register_with_trips() can fail for a number of
> reasons, including allocation failures.  Check for error pointers to
> avoid an error pointer dereference.
> 
> Fixes: 9d617949d490 ("thermal/drivers/renesas: Group all renesas thermal drivers together")

I don't think this is correct as this commits just moves the file.

> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
>  drivers/thermal/renesas/rcar_thermal.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/thermal/renesas/rcar_thermal.c b/drivers/thermal/renesas/rcar_thermal.c
> index 6e5dcac5d47a..71f836fbc698 100644
> --- a/drivers/thermal/renesas/rcar_thermal.c
> +++ b/drivers/thermal/renesas/rcar_thermal.c
> @@ -492,6 +492,11 @@ static int rcar_thermal_probe(struct platform_device *pdev)
>  				"rcar_thermal", trips, ARRAY_SIZE(trips), priv,
>  						&rcar_thermal_zone_ops, NULL, 0,
>  						idle);
> +			if (IS_ERR(priv->zone)) {
> +				ret = PTR_ERR(priv->zone);
> +				priv->zone = NULL;
> +				goto error_unregister;
> +			}

While this indeed is an issue that should be fixed I don't think this is 
the correct fix. Below the if .. else .. block where this is added there 
already is a check for IS_ERR(priv->zone). That however does not guard 
against the usage of priv->zone for thermal_zone_device_enable().

We should only call thermal_zone_device_enable() if we are on a system 
that uses OF (gated by chip->use_of_thermal) which is the reason for the 
if .. else .. block in the first place. As chance have it we also have a 
check on chip->use_of_thermal directly after the existing 
IS_ERR(priv->zone) check. I think it would be better to move the call to 
thermal_zone_device_enable() there and avoid having two checks for 
IS_ERR(priv->zone)? Something like this,

diff --git a/drivers/thermal/renesas/rcar_thermal.c b/drivers/thermal/renesas/rcar_thermal.c
index 6e5dcac5d47a..dd13cf971ddb 100644
--- a/drivers/thermal/renesas/rcar_thermal.c
+++ b/drivers/thermal/renesas/rcar_thermal.c
@@ -492,12 +492,6 @@ static int rcar_thermal_probe(struct platform_device *pdev)
 				"rcar_thermal", trips, ARRAY_SIZE(trips), priv,
 						&rcar_thermal_zone_ops, NULL, 0,
 						idle);
-
-			ret = thermal_zone_device_enable(priv->zone);
-			if (ret) {
-				thermal_zone_device_unregister(priv->zone);
-				priv->zone = ERR_PTR(ret);
-			}
 		}
 		if (IS_ERR(priv->zone)) {
 			dev_err(dev, "can't register thermal zone\n");
@@ -507,13 +501,16 @@ static int rcar_thermal_probe(struct platform_device *pdev)
 		}

 		if (chip->use_of_thermal) {
+			ret = thermal_zone_device_enable(priv->zone);
+			if (ret)
+				goto error_of_thermal;
+
 			ret = thermal_add_hwmon_sysfs(priv->zone);
 			if (ret)
-				goto error_unregister;
+				goto error_of_thermal;
 		}

 		rcar_thermal_irq_enable(priv);
-
 		list_move_tail(&priv->list, &common->head);

 		/* update ENR bits */
@@ -528,6 +525,8 @@ static int rcar_thermal_probe(struct platform_device *pdev)

 	return 0;

+error_of_thermal:
+	thermal_zone_device_unregister(priv->zone);
 error_unregister:
 	rcar_thermal_remove(pdev);

>  
>  			ret = thermal_zone_device_enable(priv->zone);
>  			if (ret) {
> -- 
> 2.53.0
> 

-- 
Kind Regards,
Niklas Söderlund

Re: [PATCH] thermal/drivers/rcar: add error checking in probe()

[Dan Carpenter]

On Tue, Jun 23, 2026 at 10:18:22AM +0200, Niklas Söderlund wrote:
> Hi Dan,
> 
> Thanks for your work.
> 
> On 2026-06-23 10:49:29 +0300, Dan Carpenter wrote:
> > The thermal_zone_device_register_with_trips() can fail for a number of
> > reasons, including allocation failures.  Check for error pointers to
> > avoid an error pointer dereference.
> > 
> > Fixes: 9d617949d490 ("thermal/drivers/renesas: Group all renesas thermal drivers together")
> 
> I don't think this is correct as this commits just moves the file.
> 
> > Signed-off-by: Dan Carpenter <error27@gmail.com>
> > ---
> >  drivers/thermal/renesas/rcar_thermal.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> > 
> > diff --git a/drivers/thermal/renesas/rcar_thermal.c b/drivers/thermal/renesas/rcar_thermal.c
> > index 6e5dcac5d47a..71f836fbc698 100644
> > --- a/drivers/thermal/renesas/rcar_thermal.c
> > +++ b/drivers/thermal/renesas/rcar_thermal.c
> > @@ -492,6 +492,11 @@ static int rcar_thermal_probe(struct platform_device *pdev)
> >  				"rcar_thermal", trips, ARRAY_SIZE(trips), priv,
> >  						&rcar_thermal_zone_ops, NULL, 0,
> >  						idle);
> > +			if (IS_ERR(priv->zone)) {
> > +				ret = PTR_ERR(priv->zone);
> > +				priv->zone = NULL;
> > +				goto error_unregister;
> > +			}
> 
> While this indeed is an issue that should be fixed I don't think this is 
> the correct fix. Below the if .. else .. block where this is added there 
> already is a check for IS_ERR(priv->zone). That however does not guard 
> against the usage of priv->zone for thermal_zone_device_enable().
> 
> We should only call thermal_zone_device_enable() if we are on a system 
> that uses OF (gated by chip->use_of_thermal) which is the reason for the 
> if .. else .. block in the first place.

Uh, what?  Other way around.  Only when use_of_thermal is false.
This function is weirdly confusing...  Also the rcar_thermal_remove()
function already calls thermal_zone_device_unregister().  I'll send a
v2 later.

regards,
dan carpenter