Re: [PATCH] thermal: intel: int340x: Fix use-after-free in proc_thermal_pci

[Rafael J. Wysocki (Intel)]

On Wed, Sep 23, 2026 at 9:28 AM Fan Wu <fanwu01@xxxxxxxxxx> wrote:
>
> proc_thermal_pci_remove() cancels pci_info->work before disabling the
> interrupt sources that schedule it. A threshold IRQ which arrives after
> the cancel but before the THRES_0 and INT_ENABLE_0 MMIO mask makes
> proc_thermal_irq_handler() reschedule the work, so
> proc_thermal_threshold_work_fn() runs after devm cleanup has freed
> pci_info and dereferences pci_info->tzone and proc_priv->mmio_base. The
> shared IRQ is never freed in remove(), which widens the window, and the
> probe error paths never cancel the work either.
>
> Fix this by cutting off the producers before draining: mask the THRES_0
> and INT_ENABLE_0 registers, free the MSI interrupts or the shared IRQ,
> and only then cancel the delayed work. The probe error paths cancel the
> work before the thermal zone is unregistered.
>
> The work function re-enables the INT_ENABLE_0 bit, but the IRQs are
> already freed when it is cancelled and THRES_0 stays cleared, so nothing
> can schedule the work again.
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: acd65d5d1cf4 ("thermal/drivers/int340x/processor_thermal: Add PCI MMIO based thermal driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Song Li <songl@xxxxxxxxxx>
> Signed-off-by: Song Li <songl@xxxxxxxxxx>
> Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>

Please see Sashiko's feedback on this:

https://sashiko.dev/#/patchset/20260923072730.487900-1-fanwu01%40zju.edu.cn

and let me know what you think.

Thanks!

> ---
>  .../processor_thermal_device_pci.c                | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c
> index c693d93..1856e76 100644
> --- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c
> +++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c
> @@ -409,7 +409,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, const struct pci_device_
>  err_free_vectors:
>         if (msi_irq)
>                 proc_thermal_free_msi(pdev, pci_info);
> +       else
> +               devm_free_irq(&pdev->dev, pdev->irq, pci_info);
>  err_ret_tzone:
> +       cancel_delayed_work_sync(&pci_info->work);
>         thermal_zone_device_unregister(pci_info->tzone);
>  err_del_legacy:
>         if (!pci_info->no_legacy)
> @@ -424,13 +427,16 @@ static void proc_thermal_pci_remove(struct pci_dev *pdev)
>         struct proc_thermal_device *proc_priv = pci_get_drvdata(pdev);
>         struct proc_thermal_pci *pci_info = proc_priv->priv_data;
>
> -       cancel_delayed_work_sync(&pci_info->work);
> -
>         proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_THRES_0, 0);
>         proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_INT_ENABLE_0, 0);
>
>         if (msi_irq)
>                 proc_thermal_free_msi(pdev, pci_info);
> +       else
> +               devm_free_irq(&pdev->dev, pdev->irq, pci_info);
> +
> +       /* Cancel after the IRQs are freed, or the handler may reschedule it. */
> +       cancel_delayed_work_sync(&pci_info->work);
>
>         thermal_zone_device_unregister(pci_info->tzone);
>         proc_thermal_mmio_remove(pdev, pci_info->proc_priv);
>