[PATCH] rc: img-ir: fix error in parameters passed to irq_free()

[PATCH] rc: img-ir: fix error in parameters passed to irq_free()

[Sifan Naeem]

img_ir_remove() passes a pointer to the ISR function as the 2nd
parameter to irq_free() instead of a pointer to the device data
structure.
This issue causes unloading img-ir module to fail with the below
warning after building and loading img-ir as a module.

WARNING: CPU: 2 PID: 155 at ../kernel/irq/manage.c:1278
__free_irq+0xb4/0x214() Trying to free already-free IRQ 58
Modules linked in: img_ir(-)
CPU: 2 PID: 155 Comm: rmmod Not tainted 3.14.0 #55 ...
Call Trace:
...
[<8048d420>] __free_irq+0xb4/0x214
[<8048d6b4>] free_irq+0xac/0xf4
[<c009b130>] img_ir_remove+0x54/0xd4 [img_ir] [<8073ded0>]
platform_drv_remove+0x30/0x54 ...

Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com>
Fixes: 160a8f8aec4d ("[media] rc: img-ir: add base driver")
Cc: <stable@vger.kernel.org> # 3.15+
---
 drivers/media/rc/img-ir/img-ir-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/img-ir/img-ir-core.c b/drivers/media/rc/img-ir/img-ir-core.c
index 77c78de..7020659 100644
--- a/drivers/media/rc/img-ir/img-ir-core.c
+++ b/drivers/media/rc/img-ir/img-ir-core.c
@@ -146,7 +146,7 @@ static int img_ir_remove(struct platform_device *pdev)
 {
 	struct img_ir_priv *priv = platform_get_drvdata(pdev);
 
-	free_irq(priv->irq, img_ir_isr);
+	free_irq(priv->irq, priv);
 	img_ir_remove_hw(priv);
 	img_ir_remove_raw(priv);
 
-- 
1.7.9.5

Re: [PATCH] rc: img-ir: fix error in parameters passed to irq_free()

[James Hogan]

[-- Attachment #1: Type: text/plain, Size: 1846 bytes --]

On Tue, Feb 10, 2015 at 10:41:56AM +0000, Sifan Naeem wrote:
> img_ir_remove() passes a pointer to the ISR function as the 2nd
> parameter to irq_free() instead of a pointer to the device data
> structure.
> This issue causes unloading img-ir module to fail with the below
> warning after building and loading img-ir as a module.
> 
> WARNING: CPU: 2 PID: 155 at ../kernel/irq/manage.c:1278
> __free_irq+0xb4/0x214() Trying to free already-free IRQ 58
> Modules linked in: img_ir(-)
> CPU: 2 PID: 155 Comm: rmmod Not tainted 3.14.0 #55 ...
> Call Trace:
> ...
> [<8048d420>] __free_irq+0xb4/0x214
> [<8048d6b4>] free_irq+0xac/0xf4
> [<c009b130>] img_ir_remove+0x54/0xd4 [img_ir] [<8073ded0>]
> platform_drv_remove+0x30/0x54 ...
> 
> Signed-off-by: Sifan Naeem <sifan.naeem@imgtec.com>
> Fixes: 160a8f8aec4d ("[media] rc: img-ir: add base driver")
> Cc: <stable@vger.kernel.org> # 3.15+

Thanks for catching this Sifan. It appears to have been introduced while
getting the driver ready for upstream (it used to use the devm_* API to
request the IRQ, but I changed it to avoid the ISR racing with module
removal).

Acked-by: James Hogan <james.hogan@imgtec.com>

Cheers
James

> ---
>  drivers/media/rc/img-ir/img-ir-core.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/rc/img-ir/img-ir-core.c b/drivers/media/rc/img-ir/img-ir-core.c
> index 77c78de..7020659 100644
> --- a/drivers/media/rc/img-ir/img-ir-core.c
> +++ b/drivers/media/rc/img-ir/img-ir-core.c
> @@ -146,7 +146,7 @@ static int img_ir_remove(struct platform_device *pdev)
>  {
>  	struct img_ir_priv *priv = platform_get_drvdata(pdev);
>  
> -	free_irq(priv->irq, img_ir_isr);
> +	free_irq(priv->irq, priv);
>  	img_ir_remove_hw(priv);
>  	img_ir_remove_raw(priv);
>  
> -- 
> 1.7.9.5
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]