[PATCH] thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove

[PATCH] thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove

[Weigang He]

On a threshold crossing, the talert IRQ handler calls
ti_thermal_report_sensor_temperature(), which queues the work embedded
in the sensor's ti_thermal_data on the system workqueue. Nothing ever
cancels or flushes that work.

ti_bandgap_remove() frees the talert IRQ last. free_irq() waits for a
running handler, but not for the work the handler has queued. When
remove returns, devres unregisters and frees the thermal zones and then
frees the devm-allocated ti_thermal_data, so a work item that is still
pending runs ti_thermal_work() on freed memory:

	ti_thermal_work()
	  data = container_of(work, struct ti_thermal_data, thermal_wq);
	  thermal_zone_device_update(data->ti_thermal, ...);

Free the talert IRQ before removing the sensors, so that no new work
can be queued, and cancel the work in ti_thermal_remove_sensor().

This needs an OMAP4460/4470 or OMAP5 SoC (DRA7 has TALERT but no
->report_temperature, so it never queues the work), a threshold crossing
just before the driver is unbound or unloaded, and the work still
pending when devres frees the data.

Found by static analysis tool CodeQL.

Fixes: 445eaf871bf9 ("staging: omap-thermal: common code to expose driver to thermal framework")
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
---

Notes:
    Compile-tested only (ARCH=arm64 and ARCH=x86_64 allmodconfig, and
    ARCH=arm multi_v7_defconfig, W=1). Not tested on hardware: I have no
    OMAP4460/4470 or OMAP5 board, and there is no reproducer. Unbinding or
    unloading the driver needs root, so this is sent as a regular bug; no
    stable Cc, but please add one if you think it is warranted.
    
    Found while reviewing a CodeQL report for this driver.

 drivers/thermal/ti-soc-thermal/ti-bandgap.c        | 7 ++++---
 drivers/thermal/ti-soc-thermal/ti-thermal-common.c | 4 ++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/thermal/ti-soc-thermal/ti-bandgap.c b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
index ba43399d0b384..507fe67eaffae 100644
--- a/drivers/thermal/ti-soc-thermal/ti-bandgap.c
+++ b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
@@ -1077,6 +1077,10 @@ void ti_bandgap_remove(struct platform_device *pdev)
 	if (!soc_device_match(soc_no_cpu_notifier))
 		cpu_pm_unregister_notifier(&bgp->nb);
 
+	/* Stop the alerts first: they queue work on the sensors' data */
+	if (TI_BANDGAP_HAS(bgp, TALERT))
+		free_irq(bgp->irq, bgp);
+
 	/* Remove sensor interfaces */
 	for (i = 0; i < bgp->conf->sensor_count; i++) {
 		if (bgp->conf->sensors[i].unregister_cooling)
@@ -1093,9 +1097,6 @@ void ti_bandgap_remove(struct platform_device *pdev)
 	clk_put(bgp->fclock);
 	clk_put(bgp->div_clk);
 
-	if (TI_BANDGAP_HAS(bgp, TALERT))
-		free_irq(bgp->irq, bgp);
-
 	if (TI_BANDGAP_HAS(bgp, TSHUT))
 		free_irq(gpiod_to_irq(bgp->tshut_gpiod), NULL);
 }
diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
index 6e1bbdee53637..3073d4d9e4f36 100644
--- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c
@@ -195,6 +195,10 @@ int ti_thermal_remove_sensor(struct ti_bandgap *bgp, int id)
 
 	data = ti_bandgap_get_sensor_data(bgp, id);
 
+	/* Work queued by the talert IRQ must not outlive the data */
+	if (!IS_ERR_OR_NULL(data))
+		cancel_work_sync(&data->thermal_wq);
+
 	if (!IS_ERR_OR_NULL(data) && data->ti_thermal) {
 		if (data->our_zone)
 			thermal_zone_device_unregister(data->ti_thermal);

base-commit: 165768bb70265b5c38cf0b73fafd75be235f8b14
-- 
2.43.0

Re: [PATCH] thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove

[Daniel Lezcano]

On 9/26/26 14:49, Weigang He wrote:
> On a threshold crossing, the talert IRQ handler calls
> ti_thermal_report_sensor_temperature(), which queues the work embedded
> in the sensor's ti_thermal_data on the system workqueue. Nothing ever
> cancels or flushes that work.
> 
> ti_bandgap_remove() frees the talert IRQ last. free_irq() waits for a
> running handler, but not for the work the handler has queued. When
> remove returns, devres unregisters and frees the thermal zones and then
> frees the devm-allocated ti_thermal_data, so a work item that is still
> pending runs ti_thermal_work() on freed memory:
> 
> 	ti_thermal_work()
> 	  data = container_of(work, struct ti_thermal_data, thermal_wq);
> 	  thermal_zone_device_update(data->ti_thermal, ...);
> 
> Free the talert IRQ before removing the sensors, so that no new work
> can be queued, and cancel the work in ti_thermal_remove_sensor().
> 
> This needs an OMAP4460/4470 or OMAP5 SoC (DRA7 has TALERT but no
> ->report_temperature, so it never queues the work), a threshold crossing
> just before the driver is unbound or unloaded, and the work still
> pending when devres frees the data.
> 
> Found by static analysis tool CodeQL.
> 
> Fixes: 445eaf871bf9 ("staging: omap-thermal: common code to expose driver to thermal framework")
> Assisted-by: LLM codeql
> Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
> ---
Sounds correct to me, so if nobody is against this change I'll apply it

Thanks

RE: [PATCH] thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove

[J, KEERTHY]

-----Original Message-----
From: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> 
Sent: Tuesday, September 29, 2026 12:45 PM
To: Weigang He <geoffreyhe2@gmail.com>; Daniel Lezcano <daniel.lezcano@kernel.org>; Rafael J . Wysocki <rafael@kernel.org>; Eduardo Valentin <edubezval@gmail.com>; J, KEERTHY <j-keerthy@ti.com>
Cc: Zhang Rui <rui.zhang@intel.com>; Lukasz Luba <lukasz.luba@arm.com>; linux-pm@vger.kernel.org; linux-omap@vger.kernel.org; linux-kernel@vger.kernel.org
Subject: Re: [PATCH] thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove

On 9/26/26 14:49, Weigang He wrote:
> On a threshold crossing, the talert IRQ handler calls 
> ti_thermal_report_sensor_temperature(), which queues the work embedded 
> in the sensor's ti_thermal_data on the system workqueue. Nothing ever 
> cancels or flushes that work.
> 
> ti_bandgap_remove() frees the talert IRQ last. free_irq() waits for a 
> running handler, but not for the work the handler has queued. When 
> remove returns, devres unregisters and frees the thermal zones and 
> then frees the devm-allocated ti_thermal_data, so a work item that is 
> still pending runs ti_thermal_work() on freed memory:
> 
> 	ti_thermal_work()
> 	  data = container_of(work, struct ti_thermal_data, thermal_wq);
> 	  thermal_zone_device_update(data->ti_thermal, ...);
> 
> Free the talert IRQ before removing the sensors, so that no new work 
> can be queued, and cancel the work in ti_thermal_remove_sensor().
> 
> This needs an OMAP4460/4470 or OMAP5 SoC (DRA7 has TALERT but no
> ->report_temperature, so it never queues the work), a threshold 
> ->crossing
> just before the driver is unbound or unloaded, and the work still 
> pending when devres frees the data.
> 
> Found by static analysis tool CodeQL.
> 
> Fixes: 445eaf871bf9 ("staging: omap-thermal: common code to expose 
> driver to thermal framework")
> Assisted-by: LLM codeql
> Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
> ---
Sounds correct to me, so if nobody is against this change I'll apply it

> FWIW: Acked-by: Keerthy <j-keerthy@ti.com>

Thanks