Re: [PATCH] thermal: intel: int340x: Fix use-after-free in proc_thermal_pci

[srinivas pandruvada]

On Wed, 2026-09-23 at 07:27 +0000, Fan Wu wrote:
> proc_thermal_pci_remove() cancels pci_info->work before disabling the
> interrupt sources that schedule it. A threshold IRQ which arrives
> after
> the cancel but before the THRES_0 and INT_ENABLE_0 MMIO mask makes
> proc_thermal_irq_handler() reschedule the work, so
> proc_thermal_threshold_work_fn() runs after devm cleanup has freed
> pci_info and dereferences pci_info->tzone and proc_priv->mmio_base.
> The
> shared IRQ is never freed in remove(), which widens the window, and
> the
> probe error paths never cancel the work either.
> 
> Fix this by cutting off the producers before draining: mask the
> THRES_0
> and INT_ENABLE_0 registers, free the MSI interrupts or the shared
> IRQ,
> and only then cancel the delayed work. The probe error paths cancel
> the
> work before the thermal zone is unregistered.
> 
> The work function re-enables the INT_ENABLE_0 bit, but the IRQs are
> already freed when it is cancelled and THRES_0 stays cleared, so
> nothing
> can schedule the work again.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: acd65d5d1cf4 ("thermal/drivers/int340x/processor_thermal: Add
> PCI MMIO based thermal driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Song Li <songl@xxxxxxxxxx>
> Signed-off-by: Song Li <songl@xxxxxxxxxx>
> Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>

Acked-by: Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>

> ---
>  .../processor_thermal_device_pci.c                | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git
> a/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.
> c
> b/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.
> c
> index c693d93..1856e76 100644
> ---
> a/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.
> c
> +++
> b/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.
> c
> @@ -409,7 +409,10 @@ static int proc_thermal_pci_probe(struct pci_dev
> *pdev, const struct pci_device_
>  err_free_vectors:
>  	if (msi_irq)
>  		proc_thermal_free_msi(pdev, pci_info);
> +	else
> +		devm_free_irq(&pdev->dev, pdev->irq, pci_info);
>  err_ret_tzone:
> +	cancel_delayed_work_sync(&pci_info->work);
>  	thermal_zone_device_unregister(pci_info->tzone);
>  err_del_legacy:
>  	if (!pci_info->no_legacy)
> @@ -424,13 +427,16 @@ static void proc_thermal_pci_remove(struct
> pci_dev *pdev)
>  	struct proc_thermal_device *proc_priv =
> pci_get_drvdata(pdev);
>  	struct proc_thermal_pci *pci_info = proc_priv->priv_data;
>  
> -	cancel_delayed_work_sync(&pci_info->work);
> -
>  	proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_THRES_0,
> 0);
>  	proc_thermal_mmio_write(pci_info,
> PROC_THERMAL_MMIO_INT_ENABLE_0, 0);
>  
>  	if (msi_irq)
>  		proc_thermal_free_msi(pdev, pci_info);
> +	else
> +		devm_free_irq(&pdev->dev, pdev->irq, pci_info);
> +
> +	/* Cancel after the IRQs are freed, or the handler may
> reschedule it. */
> +	cancel_delayed_work_sync(&pci_info->work);
>  
>  	thermal_zone_device_unregister(pci_info->tzone);
>  	proc_thermal_mmio_remove(pdev, pci_info->proc_priv);