d40_probe() registers the hardware interrupt before several later probe steps that can fail. Those error paths jump to destroy_cache without freeing the IRQ, leaving the handler registered after probe resources have been released.
Track successful IRQ registration and free the IRQ on later probe failure. Reported-by: [email protected] Closes: https://lore.kernel.org/dmaengine/[email protected]/ Assisted-by: Codex:gpt-5-5 Signed-off-by: Linus Walleij <[email protected]> --- drivers/dma/ste_dma40.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c index 0c9094b4c4ad..8cf73b37f8bf 100644 --- a/drivers/dma/ste_dma40.c +++ b/drivers/dma/ste_dma40.c @@ -3513,6 +3513,7 @@ static int __init d40_probe(struct platform_device *pdev) void *dmaenginem_reg_group; int num_reserved_chans; bool runtime_pm_enabled = false; + bool irq_requested = false; u32 val; int ret; @@ -3605,6 +3606,7 @@ static int __init d40_probe(struct platform_device *pdev) d40_err(dev, "No IRQ defined\n"); goto destroy_cache; } + irq_requested = true; if (base->plat_data->use_esram_lcla) { @@ -3680,6 +3682,8 @@ static int __init d40_probe(struct platform_device *pdev) regulator_disable(base->lcpa_regulator); regulator_put(base->lcpa_regulator); } + if (irq_requested) + free_irq(base->irq, base); if (runtime_pm_enabled) pm_runtime_disable(base->dev); -- 2.55.0
