On Thu, Sep 17, 2026 at 04:01:36PM -0400, Myeonghun Pak wrote:
> The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove()
> releases that object before tearing down the interrupts. The IRQ was
> requested with devm_request_irq(), and unregister_dpio_irq_handlers()
> only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources
> to the MC resource pool without freeing the handler. An interrupt can
> therefore access the freed I/O object before devres releases the IRQ.
>
> Explicitly free the managed IRQ before returning its resource to the
> pool, and perform IRQ teardown before releasing the I/O object. This
> also waits for an in-flight handler while the object is still valid.
>
> This issue was identified during our ongoing static-analysis research
> while reviewing kernel code.
>
> Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver")
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <[email protected]>
> Signed-off-by: Ijae Kim <[email protected]>
> Signed-off-by: Myeonghun Pak <[email protected]>
> ---
> drivers/soc/fsl/dpio/dpio-driver.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/soc/fsl/dpio/dpio-driver.c
> b/drivers/soc/fsl/dpio/dpio-driver.c
> index d5198ffc4455..fa82cdcc4922 100644
> --- a/drivers/soc/fsl/dpio/dpio-driver.c
> +++ b/drivers/soc/fsl/dpio/dpio-driver.c
> @@ -263,6 +263,8 @@ static int dpaa2_dpio_probe(struct fsl_mc_device
> *dpio_dev)
> static void dpio_teardown_irqs(struct fsl_mc_device *dpio_dev)
> {
> unregister_dpio_irq_handlers(dpio_dev);
> + devm_free_irq(&dpio_dev->dev, dpio_dev->irqs[0]->virq,
> + &dpio_dev->dev);
I would suggest moving the devm_free_irq() call inside
unregister_dpio_irq_handlers() so that we keep the register_ and
unregister_ in sync.
Thanks,
Ioana
