linux.git/drivers/thermal, branch v6.18.22 Clone of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git thermal: core: Fix thermal zone device registration error path 2026-04-11T12:26:47+00:00 Rafael J. Wysocki rafael.j.wysocki@intel.com 2026-04-01T14:33:53+00:00 c4c7219e93319bba9ba0765dee597784c78f63c5 commit 9e07e3b81807edd356e1f794cffa00a428eff443 upstream. If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal completion like thermal_zone_device_unregister(), in case user space has managed to take a reference to the thermal zone device's kobject, in which case thermal_release() may not be called by the error path itself and tz may be freed prematurely. Add the missing wait_for_completion() call to the thermal zone device registration error path. Fixes: 04e6ccfc93c5 ("thermal: core: Fix NULL pointer dereference in zone registration error path") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Cc: All applicable <stable@vger.kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Tested-by: Lukasz Luba <lukasz.luba@arm.com> Link: https://patch.msgid.link/2849815.mvXUDI8C0e@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 9e07e3b81807edd356e1f794cffa00a428eff443 upstream.

If thermal_zone_device_register_with_trips() fails after registering
a thermal zone device, it needs to wait for the tz->removal completion
like thermal_zone_device_unregister(), in case user space has managed
to take a reference to the thermal zone device's kobject, in which case
thermal_release() may not be called by the error path itself and tz may
be freed prematurely.

Add the missing wait_for_completion() call to the thermal zone device
registration error path.

Fixes: 04e6ccfc93c5 ("thermal: core: Fix NULL pointer dereference in zone registration error path")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: All applicable <stable@vger.kernel.org>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Tested-by: Lukasz Luba <lukasz.luba@arm.com>
Link: https://patch.msgid.link/2849815.mvXUDI8C0e@rafael.j.wysocki
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
thermal: core: Address thermal zone removal races with resume 2026-04-11T12:26:47+00:00 Rafael J. Wysocki rafael.j.wysocki@intel.com 2026-03-27T09:49:52+00:00 2dbe93f344f10b432b95a23304006be805c097a1 commit 45b859b0728267a6199ee5002d62e6c6f3e8c89d upstream. Since thermal_zone_pm_complete() and thermal_zone_device_resume() re-initialize the poll_queue delayed work for the given thermal zone, the cancel_delayed_work_sync() in thermal_zone_device_unregister() may miss some already running work items and the thermal zone may be freed prematurely [1]. There are two failing scenarios that both start with running thermal_pm_notify_complete() right before invoking thermal_zone_device_unregister() for one of the thermal zones. In the first scenario, there is a work item already running for the given thermal zone when thermal_pm_notify_complete() calls thermal_zone_pm_complete() for that thermal zone and it continues to run when thermal_zone_device_unregister() starts. Since the poll_queue delayed work has been re-initialized by thermal_pm_notify_complete(), the running work item will be missed by the cancel_delayed_work_sync() in thermal_zone_device_unregister() and if it continues to run past the freeing of the thermal zone object, a use-after-free will occur. In the second scenario, thermal_zone_device_resume() queued up by thermal_pm_notify_complete() runs right after the thermal_zone_exit() called by thermal_zone_device_unregister() has returned. The poll_queue delayed work is re-initialized by it before cancel_delayed_work_sync() is called by thermal_zone_device_unregister(), so it may continue to run after the freeing of the thermal zone object, which also leads to a use-after-free. Address the first failing scenario by ensuring that no thermal work items will be running when thermal_pm_notify_complete() is called. For this purpose, first move the cancel_delayed_work() call from thermal_zone_pm_complete() to thermal_zone_pm_prepare() to prevent new work from entering the workqueue going forward. Next, switch over to using a dedicated workqueue for thermal events and update the code in thermal_pm_notify() to flush that workqueue after thermal_pm_notify_prepare() has returned which will take care of all leftover thermal work already on the workqueue (that leftover work would do nothing useful anyway because all of the thermal zones have been flagged as suspended). The second failing scenario is addressed by adding a tz->state check to thermal_zone_device_resume() to prevent it from re-initializing the poll_queue delayed work if the thermal zone is going away. Note that the above changes will also facilitate relocating the suspend and resume of thermal zones closer to the suspend and resume of devices, respectively. Fixes: 5a5efdaffda5 ("thermal: core: Resume thermal zones asynchronously") Reported-by: syzbot+3b3852c6031d0f30dfaf@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=3b3852c6031d0f30dfaf Reported-by: Mauricio Faria de Oliveira <mfo@igalia.com> Closes: https://lore.kernel.org/linux-pm/20260324-thermal-core-uaf-init_delayed_work-v1-1-6611ae76a8a1@igalia.com/ [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Mauricio Faria de Oliveira <mfo@igalia.com> Tested-by: Mauricio Faria de Oliveira <mfo@igalia.com> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Cc: All applicable <stable@vger.kernel.org> Link: https://patch.msgid.link/6267615.lOV4Wx5bFT@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 45b859b0728267a6199ee5002d62e6c6f3e8c89d upstream.

Since thermal_zone_pm_complete() and thermal_zone_device_resume()
re-initialize the poll_queue delayed work for the given thermal zone,
the cancel_delayed_work_sync() in thermal_zone_device_unregister()
may miss some already running work items and the thermal zone may
be freed prematurely [1].

There are two failing scenarios that both start with
running thermal_pm_notify_complete() right before invoking
thermal_zone_device_unregister() for one of the thermal zones.

In the first scenario, there is a work item already running for
the given thermal zone when thermal_pm_notify_complete() calls
thermal_zone_pm_complete() for that thermal zone and it continues to
run when thermal_zone_device_unregister() starts.  Since the poll_queue
delayed work has been re-initialized by thermal_pm_notify_complete(), the
running work item will be missed by the cancel_delayed_work_sync() in
thermal_zone_device_unregister() and if it continues to run past the
freeing of the thermal zone object, a use-after-free will occur.

In the second scenario, thermal_zone_device_resume() queued up by
thermal_pm_notify_complete() runs right after the thermal_zone_exit()
called by thermal_zone_device_unregister() has returned.  The poll_queue
delayed work is re-initialized by it before cancel_delayed_work_sync() is
called by thermal_zone_device_unregister(), so it may continue to run
after the freeing of the thermal zone object, which also leads to a
use-after-free.

Address the first failing scenario by ensuring that no thermal work
items will be running when thermal_pm_notify_complete() is called.
For this purpose, first move the cancel_delayed_work() call from
thermal_zone_pm_complete() to thermal_zone_pm_prepare() to prevent
new work from entering the workqueue going forward.  Next, switch
over to using a dedicated workqueue for thermal events and update
the code in thermal_pm_notify() to flush that workqueue after
thermal_pm_notify_prepare() has returned which will take care of
all leftover thermal work already on the workqueue (that leftover
work would do nothing useful anyway because all of the thermal zones
have been flagged as suspended).

The second failing scenario is addressed by adding a tz->state check
to thermal_zone_device_resume() to prevent it from re-initializing
the poll_queue delayed work if the thermal zone is going away.

Note that the above changes will also facilitate relocating the suspend
and resume of thermal zones closer to the suspend and resume of devices,
respectively.

Fixes: 5a5efdaffda5 ("thermal: core: Resume thermal zones asynchronously")
Reported-by: syzbot+3b3852c6031d0f30dfaf@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=3b3852c6031d0f30dfaf
Reported-by: Mauricio Faria de Oliveira <mfo@igalia.com>
Closes: https://lore.kernel.org/linux-pm/20260324-thermal-core-uaf-init_delayed_work-v1-1-6611ae76a8a1@igalia.com/ [1]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mauricio Faria de Oliveira <mfo@igalia.com>
Tested-by: Mauricio Faria de Oliveira <mfo@igalia.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/6267615.lOV4Wx5bFT@rafael.j.wysocki
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
thermal: intel: int340x: soc_slider: Set offset only for balanced mode 2026-04-02T11:23:18+00:00 Srinivas Pandruvada srinivas.pandruvada@linux.intel.com 2026-03-24T17:23:46+00:00 ab839325a41c98f69f332450881fa024ea6cc5dc commit 7dfe9846016b15816e287a4650be1ff1b48c5ab4 upstream. The slider offset can be set via debugfs for balanced mode. The offset should be only applicable in balanced mode. For other modes, it should be 0 when writing to MMIO offset, Fixes: 8306bcaba06d ("thermal: intel: int340x: Add module parameter to change slider offset") Tested-by: Erin Park <erin.park@intel.com> Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Cc: 6.18+ <stable@vger.kernel.org> # 6.18+ [ rjw: Subject and changelog tweaks ] Link: https://patch.msgid.link/20260324172346.3317145-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit 7dfe9846016b15816e287a4650be1ff1b48c5ab4 upstream.

The slider offset can be set via debugfs for balanced mode. The offset
should be only applicable in balanced mode. For other modes, it should
be 0 when writing to MMIO offset,

Fixes: 8306bcaba06d ("thermal: intel: int340x: Add module parameter to change slider offset")
Tested-by: Erin Park <erin.park@intel.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: 6.18+ <stable@vger.kernel.org> # 6.18+
[ rjw: Subject and changelog tweaks ]
Link: https://patch.msgid.link/20260324172346.3317145-1-srinivas.pandruvada@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
thermal: int340x: Fix sysfs group leak on DLVR registration failure 2026-03-04T12:20:38+00:00 Kaushlendra Kumar kaushlendra.kumar@intel.com 2026-02-11T08:23:15+00:00 5c4e940075bd64eeaca33695dfc9b9f60bfa2748 [ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ] When DLVR sysfs group creation fails in proc_thermal_rfim_add(), the function returns immediately without cleaning up the FIVR group that may have been created earlier. Add proper error unwinding to remove the FIVR group before returning failure. Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com> Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 15176b818e048ccf6ef4b96db34eda7b7e98938a ]

When DLVR sysfs group creation fails in proc_thermal_rfim_add(),
the function returns immediately without cleaning up the FIVR group
that may have been created earlier.

Add proper error unwinding to remove the FIVR group before returning
failure.

Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/LV3PR11MB876881B77D32A2854AD2908EF563A@LV3PR11MB8768.namprd11.prod.outlook.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
thermal/of: Fix reference leak in thermal_of_cm_lookup() 2026-02-26T22:59:00+00:00 Felix Gu ustc.gu@gmail.com 2026-01-23T19:06:40+00:00 8344d5da9df74fdbef676214d0c482fc822a01ca [ Upstream commit a1fe789a96fe47733c133134fd264cb7ca832395 ] In thermal_of_cm_lookup(), tr_np is obtained via of_parse_phandle(), but never released. Use the __free(device_node) cleanup attribute to automatically release the node and fix the leak. Fixes: 423de5b5bc5b ("thermal/of: Fix cdev lookup in thermal_of_should_bind()") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> [ rjw: Changelog edits ] Link: https://patch.msgid.link/20260124-thermal_of-v1-1-54d3416948cf@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit a1fe789a96fe47733c133134fd264cb7ca832395 ]

In thermal_of_cm_lookup(), tr_np is obtained via of_parse_phandle(), but
never released.

Use the __free(device_node) cleanup attribute to automatically release
the node and fix the leak.

Fixes: 423de5b5bc5b ("thermal/of: Fix cdev lookup in thermal_of_should_bind()")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260124-thermal_of-v1-1-54d3416948cf@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature 2026-02-26T22:59:00+00:00 Rafael J. Wysocki rafael.j.wysocki@intel.com 2026-01-20T15:23:41+00:00 649ddf7e5aa64ef53e039fb9daea51f0b6460b02 [ Upstream commit 9635c586a559ba0e45b2bfbff79c937ddbaf1a62 ] After commit be0a3600aa1e ("thermal: sysfs: Rework the handling of trip point updates"), THERMAL_TEMP_INVALID can be passed to sys_set_trip_temp() and it is treated as a regular temperature value there, so the sysfs write fails even though it is expected to succeed and disable the given trip point. Address this by making sys_set_trip_temp() clear its temp variable when it is equal to THERMAL_TEMP_INVALID. Fixes: be0a3600aa1e ("thermal: sysfs: Rework the handling of trip point updates") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/2815400.mvXUDI8C0e@rafael.j.wysocki Signed-off-by: Sasha Levin <sashal@kernel.org> 
[ Upstream commit 9635c586a559ba0e45b2bfbff79c937ddbaf1a62 ]

After commit be0a3600aa1e ("thermal: sysfs: Rework the handling of trip
point updates"), THERMAL_TEMP_INVALID can be passed to sys_set_trip_temp()
and it is treated as a regular temperature value there, so the sysfs
write fails even though it is expected to succeed and disable the given
trip point.

Address this by making sys_set_trip_temp() clear its temp variable when
it is equal to THERMAL_TEMP_INVALID.

Fixes: be0a3600aa1e ("thermal: sysfs: Rework the handling of trip point updates")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2815400.mvXUDI8C0e@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
thermal: renesas: Fix RZ/G3E fall-out 2025-10-02T08:41:58+00:00 Geert Uytterhoeven geert+renesas@glider.be 2025-09-30T13:47:11+00:00 e649c3662b4fd9d4e01607c91a0facc7d9005570 - Restore sort order in MAINTAINERS and Kconfig, - Remove empty trailing line from Makefile. Fixes: 19d3a401a617c68e ("thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> 
 - Restore sort order in MAINTAINERS and Kconfig,
 - Remove empty trailing line from Makefile.

Fixes: 19d3a401a617c68e ("thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Merge tag 'thermal-v6.18-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux 2025-09-28T10:01:58+00:00 Rafael J. Wysocki rafael.j.wysocki@intel.com 2025-09-28T10:01:58+00:00 2085f0f4697234a0f59ed718d0e72f38688210e0 Merge a thermal driver fix for 6.18 from Daniel Lezcano: "- Add missing file when importing conflicting change for the Renesas RZ/G3E thermal driver (Daniel Lezcano)" * tag 'thermal-v6.18-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC 
Merge a thermal driver fix for 6.18 from Daniel Lezcano:

"- Add missing file when importing conflicting change for the Renesas
   RZ/G3E thermal driver (Daniel Lezcano)"

* tag 'thermal-v6.18-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux:
  thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC
thermal/drivers/renesas/rzg3e: Fix add thermal driver for the Renesas RZ/G3E SoC 2025-09-27T22:19:53+00:00 John Madieu john.madieu.xa@bp.renesas.com 2025-09-27T21:08:24+00:00 dc67521c20b701b5237ff486ae078829dc1f8fea When applied the change commit 19d3a401a617, a conflict appeared resulting into a manual fix. However the new file rzg3e_thermal.c was not added but stayed locally in source tree and miss to be merged with the entire change. Fix this by adding the file back. Fixes: 19d3a401a617 ("Add thermal driver for the Renesas RZ/G3E SoC") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202509272225.sARVqv2G-lkp@intel.com Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> 
When applied the change commit 19d3a401a617, a conflict appeared
resulting into a manual fix. However the new file rzg3e_thermal.c was
not added but stayed locally in source tree and miss to be merged with
the entire change.

Fix this by adding the file back.

Fixes: 19d3a401a617 ("Add thermal driver for the Renesas RZ/G3E SoC")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202509272225.sARVqv2G-lkp@intel.com
Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Merge tag 'thermal-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux 2025-09-26T20:01:13+00:00 Rafael J. Wysocki rafael.j.wysocki@intel.com 2025-09-26T20:01:13+00:00 acbba7f0e5ec9736813dee221cc20f77a7d11d7b Merge updates of thermal drivers for 6.18-rc1 from Daniel Lezcano: "- Add the QCS615 compatible DT bindings for QCom platforms (Gaurav Kohli) - Support fallback trimming values when the fuse is empty in the R-Car driver (Marek Vasut) - Remove unneeded semicolon in the Mediatek LVTS driver (Jiapeng Chong) - Fix the LMH Kconfig option by selecting QCOM_SCM and take the opportunity to add the COMPILE_TEST option for the QCom's LMH feature (Dmitry Baryshkov) - Fix the missing includes and incorrect error message in the Qcom's LMH driver (Dmitry Baryshkov) - Fix comment typo and add the documentation in the Kconfig for the R-Car Gen3 and Gen4 (Marek Vasut) - Add Tegra114 SOCTHERM support (Svyatoslav Ryhel) - Rename the functions name in the driver to be consistent and generic with the different R-Car platform variants (Wolfram Sang) - Register the TI K3 J72xx bandgap sensor as a hwmon sensor too (Michael Walle) - Add and document the thermal sensor unit reporting the junction temperature of the RZ/G3S SoC (Claudiu Beznea) - Support the GRF in the Rockchip driver (Sebastian Reichel) - Add a temperature IIO sensor channel in the generic thermal ADC driver (Svyatoslav Ryhel) - Document the temperature sensor on the QCOM's Glymur platform (Manaf Meethalavalappu) - Add and document the thermal sensor unit reporting the junction temperature of the RZ/G3E SoC (John Madieu)" * tag 'thermal-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (24 commits) dt-bindings: thermal: qcom-tsens: Document the Glymur temperature Sensor thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC dt-bindings: thermal: r9a09g047-tsu: Document the TSU unit thermal/drivers/thermal-generic-adc: Add temperature sensor channel dt-bindings: thermal: rockchip: Tighten grf requirements thermal/drivers/rockchip: Shut up GRF warning thermal/drivers/rockchip: Unify struct rockchip_tsadc_chip format thermal/drivers/renesas/rzg3s: Add thermal driver for the Renesas RZ/G3S SoC dt-bindings: thermal: r9a08g045-tsu: Document the TSU unit thermal/drivers/k3_j72xx_bandgap: Register sensors with hwmon thermal/drivers/rcar_gen3: Fix mapping SoCs to generic Gen4 entry thermal/drivers/tegra: Add Tegra114 specific SOCTHERM driver dt-bindings: thermal: add Tegra114 soctherm header thermal/drivers/tegra/soctherm-fuse: Prepare calibration for Tegra114 support dt-bindings: thermal: Document Tegra114 SOCTHERM Thermal Management System thermal/drivers/rcar_gen3: Document Gen4 support in Kconfig entry thermal/drivers/rcar_gen3: Fix comment typo drivers/thermal/qcom/lmh: Fix incorrect error message thermal/drivers/qcom/lmh: Add missing IRQ includes thermal/drivers/qcom: Make LMH select QCOM_SCM ... 
Merge updates of thermal drivers for 6.18-rc1 from Daniel Lezcano:

"- Add the QCS615 compatible DT bindings for QCom platforms (Gaurav
   Kohli)

 - Support fallback trimming values when the fuse is empty in the R-Car
   driver (Marek Vasut)

 - Remove unneeded semicolon in the Mediatek LVTS driver (Jiapeng
   Chong)

 - Fix the LMH Kconfig option by selecting QCOM_SCM and take the
   opportunity to add the COMPILE_TEST option for the QCom's LMH
   feature (Dmitry Baryshkov)

 - Fix the missing includes and incorrect error message in the Qcom's
   LMH driver (Dmitry Baryshkov)

 - Fix comment typo and add the documentation in the Kconfig for the
   R-Car Gen3 and Gen4 (Marek Vasut)

 - Add Tegra114 SOCTHERM support (Svyatoslav Ryhel)

 - Rename the functions name in the driver to be consistent and generic
   with the different R-Car platform variants (Wolfram Sang)

 - Register the TI K3 J72xx bandgap sensor as a hwmon sensor too
   (Michael Walle)

 - Add and document the thermal sensor unit reporting the junction
   temperature of the RZ/G3S SoC (Claudiu Beznea)

 - Support the GRF in the Rockchip driver (Sebastian Reichel)

 - Add a temperature IIO sensor channel in the generic thermal ADC
   driver (Svyatoslav Ryhel)

 - Document the temperature sensor on the QCOM's Glymur platform (Manaf
   Meethalavalappu)

 - Add and document the thermal sensor unit reporting the junction
   temperature of the RZ/G3E SoC (John Madieu)"

* tag 'thermal-v6.18-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (24 commits)
  dt-bindings: thermal: qcom-tsens: Document the Glymur temperature Sensor
  thermal/drivers/renesas/rzg3e: Add thermal driver for the Renesas RZ/G3E SoC
  dt-bindings: thermal: r9a09g047-tsu: Document the TSU unit
  thermal/drivers/thermal-generic-adc: Add temperature sensor channel
  dt-bindings: thermal: rockchip: Tighten grf requirements
  thermal/drivers/rockchip: Shut up GRF warning
  thermal/drivers/rockchip: Unify struct rockchip_tsadc_chip format
  thermal/drivers/renesas/rzg3s: Add thermal driver for the Renesas RZ/G3S SoC
  dt-bindings: thermal: r9a08g045-tsu: Document the TSU unit
  thermal/drivers/k3_j72xx_bandgap: Register sensors with hwmon
  thermal/drivers/rcar_gen3: Fix mapping SoCs to generic Gen4 entry
  thermal/drivers/tegra: Add Tegra114 specific SOCTHERM driver
  dt-bindings: thermal: add Tegra114 soctherm header
  thermal/drivers/tegra/soctherm-fuse: Prepare calibration for Tegra114 support
  dt-bindings: thermal: Document Tegra114 SOCTHERM Thermal Management System
  thermal/drivers/rcar_gen3: Document Gen4 support in Kconfig entry
  thermal/drivers/rcar_gen3: Fix comment typo
  drivers/thermal/qcom/lmh: Fix incorrect error message
  thermal/drivers/qcom/lmh: Add missing IRQ includes
  thermal/drivers/qcom: Make LMH select QCOM_SCM
  ...