From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

If thermal_zone_device_register_with_trips() fails after registering
a thermal zone device, it needs to wait for the tz->removal completion
like thermal_zone_device_unregister(), in case user space has managed
to take a reference to the thermal zone device's kobject, in which case
thermal_release() may not be called by the error path itself and tz may
be freed prematurely.

Add the missing wait_for_completion() call to the thermal zone device
registration error path.

Fixes: 04e6ccfc93c5 ("thermal: core: Fix NULL pointer dereference in zone registration error path")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: All applicable <stable@vger.kernel.org>
---
 drivers/thermal/thermal_core.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1651,6 +1651,7 @@ unregister:
 	device_del(&tz->device);
 release_device:
 	put_device(&tz->device);
+	wait_for_completion(&tz->removal);
 remove_id:
 	ida_free(&thermal_tz_ida, id);
 free_tzp:

Hi Rafael,

On 4/1/26 15:33, Rafael J. Wysocki wrote:
> From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> 
> If thermal_zone_device_register_with_trips() fails after registering
> a thermal zone device, it needs to wait for the tz->removal completion
> like thermal_zone_device_unregister(), in case user space has managed
> to take a reference to the thermal zone device's kobject, in which case
> thermal_release() may not be called by the error path itself and tz may
> be freed prematurely.
> 
> Add the missing wait_for_completion() call to the thermal zone device
> registration error path.
> 
> Fixes: 04e6ccfc93c5 ("thermal: core: Fix NULL pointer dereference in zone registration error path")
> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> Cc: All applicable <stable@vger.kernel.org>
> ---
>   drivers/thermal/thermal_core.c |    1 +
>   1 file changed, 1 insertion(+)
> 
> --- a/drivers/thermal/thermal_core.c
> +++ b/drivers/thermal/thermal_core.c
> @@ -1651,6 +1651,7 @@ unregister:
>   	device_del(&tz->device);
>   release_device:
>   	put_device(&tz->device);
> +	wait_for_completion(&tz->removal);
>   remove_id:
>   	ida_free(&thermal_tz_ida, id);
>   free_tzp:
> 
> 
> 

LGTM. I have also tested that code path with a faked
failure from device_register() - the mechanism works.

Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Tested-by: Lukasz Luba <lukasz.luba@arm.com>

Regards,
Lukasz