From d98d8b50a87368880a58d04b48e5f66ba9d7cdc9 Mon Sep 17 00:00:00 2001 From: "Rob Herring (Arm)" Date: Mon, 31 Aug 2026 14:42:35 -0500 Subject: [PATCH 1/2] thermal: of: Match trip property helper types The thermal-zone binding defines "temperature" as a signed int32 value and "hysteresis" as an unsigned int32 value. Using helpers with matching types avoids dt_property_check mismatches and preserves the signed interpretation needed for trips below zero. Read "temperature" with the signed helper and keep "hysteresis" on the unsigned helper using separate typed temporaries before storing them in the trip structure. Signed-off-by: Rob Herring (Arm) Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20260831194235.1182138-1-robh@kernel.org Signed-off-by: Rafael J. Wysocki --- drivers/thermal/thermal_of.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c index 0217a49b08ae..deaae7a995c5 100644 --- a/drivers/thermal/thermal_of.c +++ b/drivers/thermal/thermal_of.c @@ -63,22 +63,23 @@ static int thermal_of_get_trip_type(struct device_node *np, static int thermal_of_populate_trip(struct device_node *np, struct thermal_trip *trip) { - int prop; + u32 hysteresis; + s32 temperature; int ret; - ret = of_property_read_u32(np, "temperature", &prop); + ret = of_property_read_s32(np, "temperature", &temperature); if (ret < 0) { pr_err("missing temperature property\n"); return ret; } - trip->temperature = prop; + trip->temperature = temperature; - ret = of_property_read_u32(np, "hysteresis", &prop); + ret = of_property_read_u32(np, "hysteresis", &hysteresis); if (ret < 0) { pr_err("missing hysteresis property\n"); return ret; } - trip->hysteresis = prop; + trip->hysteresis = hysteresis; ret = thermal_of_get_trip_type(np, &trip->type); if (ret < 0) { From d3515092f1bff9cfb4d99ea82dcd4ac66f32f50d Mon Sep 17 00:00:00 2001 From: Sumeet Pawnikar Date: Sat, 22 Aug 2026 17:12:36 +0530 Subject: [PATCH 2/2] thermal: gov_power_allocator: Fix NULL pointer dereference in update_tz() power_allocator_update_tz() unconditionally derives the trip descriptor of params->trip_max as below, const struct thermal_trip_desc *td = trip_to_trip_desc(params->trip_max); and then walks td->thermal_instances. However, params->trip_max is allowed to be NULL and in that case the list walk dereferences a bogus pointer derived from NULL which oops the kernel. get_governor_trips() picks trip_switch_on and trip_max out of the trip table of the zone. When the zone has neither a passive nor an active trip point, last_active is NULL and params->trip_max is left NULL. This is an explicitly supported configuration, as documented in the function get_governor_trips() as below, If there are no passive or active trip points, then the governor won't do anything. In fact, its throttle function won't be called at all. Return early from power_allocator_update_tz() when params->trip_max is NULL and only compute the trip descriptor after that check. There is nothing to update in that case anyway, with no trip_max and there are no thermal instances for the governor to account for, num_actors stays zero and total_weight is irrelevant. Fixes: 912e97c67cc3 ("thermal: gov_power_allocator: Move memory allocation out of throttle()") Signed-off-by: Sumeet Pawnikar Reviewed-by: Lukasz Luba Link: https://patch.msgid.link/20260822114236.15998-1-sumeet4linux@gmail.com Signed-off-by: Rafael J. Wysocki --- drivers/thermal/gov_power_allocator.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/thermal/gov_power_allocator.c b/drivers/thermal/gov_power_allocator.c index 37f2e22a999e..b5c254187628 100644 --- a/drivers/thermal/gov_power_allocator.c +++ b/drivers/thermal/gov_power_allocator.c @@ -660,10 +660,15 @@ static void power_allocator_update_tz(struct thermal_zone_device *tz, enum thermal_notify_event reason) { struct power_allocator_params *params = tz->governor_data; - const struct thermal_trip_desc *td = trip_to_trip_desc(params->trip_max); + const struct thermal_trip_desc *td; struct thermal_instance *instance; int num_actors = 0; + if (!params->trip_max) + return; + + td = trip_to_trip_desc(params->trip_max); + switch (reason) { case THERMAL_TZ_BIND_CDEV: case THERMAL_TZ_UNBIND_CDEV: