Hi Ioana, Thanks for the suggestion. I've moved devm_free_irq() into unregister_dpio_irq_handlers() to keep registration and unregistration in sync.
I'll resend both fixes as a two-patch v2 series, with the probe error-path cleanup first. That removes the unnecessary unregister call before the second patch adds the managed IRQ release. Thanks, Myeonghun 2026년 10월 2일 (금) 오전 6:44, Ioana Ciornei <[email protected]>님이 작성: > > On Thu, Sep 17, 2026 at 04:01:36PM -0400, Myeonghun Pak wrote: > > The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove() > > releases that object before tearing down the interrupts. The IRQ was > > requested with devm_request_irq(), and unregister_dpio_irq_handlers() > > only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources > > to the MC resource pool without freeing the handler. An interrupt can > > therefore access the freed I/O object before devres releases the IRQ. > > > > Explicitly free the managed IRQ before returning its resource to the > > pool, and perform IRQ teardown before releasing the I/O object. This > > also waits for an in-flight handler while the object is still valid. > > > > This issue was identified during our ongoing static-analysis research > > while reviewing kernel code. > > > > Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver") > > Assisted-by: LLM > > Co-developed-by: Ijae Kim <[email protected]> > > Signed-off-by: Ijae Kim <[email protected]> > > Signed-off-by: Myeonghun Pak <[email protected]> > > --- > > drivers/soc/fsl/dpio/dpio-driver.c | 6 ++++-- > > 1 file changed, 4 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/soc/fsl/dpio/dpio-driver.c > > b/drivers/soc/fsl/dpio/dpio-driver.c > > index d5198ffc4455..fa82cdcc4922 100644 > > --- a/drivers/soc/fsl/dpio/dpio-driver.c > > +++ b/drivers/soc/fsl/dpio/dpio-driver.c > > @@ -263,6 +263,8 @@ static int dpaa2_dpio_probe(struct fsl_mc_device > > *dpio_dev) > > static void dpio_teardown_irqs(struct fsl_mc_device *dpio_dev) > > { > > unregister_dpio_irq_handlers(dpio_dev); > > + devm_free_irq(&dpio_dev->dev, dpio_dev->irqs[0]->virq, > > + &dpio_dev->dev); > > > I would suggest moving the devm_free_irq() call inside > unregister_dpio_irq_handlers() so that we keep the register_ and > unregister_ in sync. > > Thanks, > Ioana
