[PATCH mt76 v4] wifi: mt76: mt7915: fix thermal zone use-after-free

[Ryan Leung via B4 Relay]

From: Ryan Leung <untilscour@xxxxxxxxxxxxxx>

The thermal zone registered via devm_thermal_of_zone_register() on the
parent device is never torn down when the phy is unregistered, so the
thermal core can still dereference it after the phy is freed.

Unregister the thermal zone alongside the cooling device in
mt7915_unregister_thermal(). Also clear phy->tzone and phy->cdev after
unregistering so the function is safe to call when only a subset of
the objects were registered, e.g. after a partially failed
mt7915_thermal_init().

While at it, include the band index in the thermal zone registration
warning to help identify which band failed on multi-band chips.

Fixes: 313f1a27ebcb ("wifi: mt76: mt7915: add thermal zone device registration")
Signed-off-by: Ryan Leung <untilscour@xxxxxxxxxxxxxx>
---
Changes in v4:
- Drop the mt7915_unregister_thermal() call on the hwmon failure path
  which was added in commit
  https://github.com/nbd168/wireless/commit/0438f51a9af4b5138d1d7117fa8343bbe6fa32f0
  ("wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure")
- Update commit message: remove the now-fixed hwmon failure leak
  description and reword accordingly.
- Link to v3: https://patch.msgid.link/20260906-mt7915-unregister-thermal-v3-1-efb2d06e61f4@xxxxxxxxxxxxxx

Changes in v3:
- Clear phy->tzone/phy->cdev in mt7915_unregister_thermal() after
  unregistering, making it idempotent.
- Link to v2: https://patch.msgid.link/20260810-mt7915-unregister-thermal-v2-1-2a0f51adf56f@xxxxxxxxxxxxxx

Changes in v2:
- Unwind cdev/tzone registration in mt7915_thermal_init() on hwmon registration failure.
- Link to v1: https://patch.msgid.link/20260810-mt7915-unregister-thermal-v1-1-c6d57b4cb368@xxxxxxxxxxxxxx
---
 drivers/net/wireless/mediatek/mt76/mt7915/init.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
index ca46a203aa48..1f1f0c109c83 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
@@ -200,11 +200,17 @@ static void mt7915_unregister_thermal(struct mt7915_phy *phy)
 {
 	struct wiphy *wiphy = phy->mt76->hw->wiphy;
 
+	if (phy->tzone) {
+		devm_thermal_of_zone_unregister(phy->dev->mt76.dev, phy->tzone);
+		phy->tzone = NULL;
+	}
+
 	if (!phy->cdev)
 		return;
 
 	sysfs_remove_link(&wiphy->dev.kobj, "cooling_device");
 	thermal_cooling_device_unregister(phy->cdev);
+	phy->cdev = NULL;
 }
 
 static int mt7915_thermal_init(struct mt7915_phy *phy)
@@ -238,8 +244,8 @@ static int mt7915_thermal_init(struct mt7915_phy *phy)
 	if (IS_ERR(phy->tzone)) {
 		if (PTR_ERR(phy->tzone) != -ENODEV)
 			dev_warn(phy->dev->mt76.dev,
-				 "failed to register thermal zone: %ld\n",
-				 PTR_ERR(phy->tzone));
+				 "failed to register thermal zone %d: %ld\n",
+				 phy->mt76->band_idx, PTR_ERR(phy->tzone));
 		phy->tzone = NULL;
 	}
 

---
base-commit: f49defea7668d8c68ec19fa085ef3da6075561c7
change-id: 20260809-mt7915-unregister-thermal-82e805c618a6

Best regards,
--  
Ryan Leung <untilscour@xxxxxxxxxxxxxx>