[PATCH mt76] wifi: mt76: mt7915: fix thermal zone use-after-free on unregister

[Ryan Leung]

phy->tzone is registered with devm_thermal_of_zone_register() against
the parent device, so its cleanup runs only after .remove() returns.
But mt7915_unregister_thermal() never unregisters it, while the phy
memory is freed earlier via mt76_free_device()/ieee80211_free_hw()
in that same .remove() path, leaving a use-after-free window.

Explicitly unregister it with devm_thermal_of_zone_unregister()
in mt7915_unregister_thermal() before the phy is freed.

While at it, include phy->mt76->band_idx in the dev_warn() message
emitted when devm_thermal_of_zone_register() fails, to help identify
which band's thermal zone registration failed on multi-band chips.

Fixes: 313f1a27ebcb ("wifi: mt76: mt7915: add thermal zone device registration")
Signed-off-by: Ryan Leung <untilscour@xxxxxxxxxxxxxx>
---
 drivers/net/wireless/mediatek/mt76/mt7915/init.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
index ca46a203aa48..e0376da79dda 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
@@ -200,6 +200,9 @@ static void mt7915_unregister_thermal(struct mt7915_phy *phy)
 {
 	struct wiphy *wiphy = phy->mt76->hw->wiphy;
 
+	if (phy->tzone)
+		devm_thermal_of_zone_unregister(phy->dev->mt76.dev, phy->tzone);
+
 	if (!phy->cdev)
 		return;
 
@@ -238,8 +241,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
 	if (IS_ERR(phy->tzone)) {
 		if (PTR_ERR(phy->tzone) != -ENODEV)
 			dev_warn(phy->dev->mt76.dev,
-				 "failed to register thermal zone: %ld\n",
-				 PTR_ERR(phy->tzone));
+				 "failed to register thermal zone %d: %ld\n",
+				 phy->mt76->band_idx, PTR_ERR(phy->tzone));
 		phy->tzone = NULL;
 	}
 

---
base-commit: ca800a9302764c445de0da0e84d2252400a770ee
change-id: 20260809-mt7915-unregister-thermal-82e805c618a6

Best regards,
--  
Ryan Leung <untilscour@xxxxxxxxxxxxxx>