[PATCH] EDAC/mpc85xx: don't use devm for request_irq()

[PATCH] EDAC/mpc85xx: don't use devm for request_irq()

[Rosen Penev]

Use modern irq acquisition APIs to avoid having to call
irq_dispose_mapping() since there's no real need to copy the mapping.

Use non devm version of request_irq() as IRQ need to be freed before
edac_device_del_device() to avoid a use after free issue.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/edac/mpc85xx_edac.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index a78d702674f6..651d14b01e25 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -253,15 +253,19 @@ static int mpc85xx_pci_err_probe(struct platform_device *op)
 	}
 
 	if (edac_op_state == EDAC_OPSTATE_INT) {
-		pdata->irq = irq_of_parse_and_map(of_node, 0);
-		res = devm_request_irq(&op->dev, pdata->irq,
+		pdata->irq = of_irq_get(of_node, 0);
+		if (pdata->irq < 0) {
+			res = pdata->irq;
+			goto err2;
+		}
+
+		res = request_irq(pdata->irq,
 				       mpc85xx_pci_isr,
 				       IRQF_SHARED,
 				       "[EDAC] PCI err", pci);
 		if (res < 0) {
 			pr_err("%s: Unable to request irq %d for MPC85xx PCI err\n",
 				__func__, pdata->irq);
-			irq_dispose_mapping(pdata->irq);
 			res = -ENODEV;
 			goto err2;
 		}
@@ -304,6 +308,9 @@ static void mpc85xx_pci_err_remove(struct platform_device *op)
 
 	edac_dbg(0, "\n");
 
+	if (edac_op_state == EDAC_OPSTATE_INT)
+		free_irq(pdata->irq, edac_dev);
+
 	out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_ADDR, orig_pci_err_cap_dr);
 	out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN, orig_pci_err_en);
 
@@ -558,14 +565,18 @@ static int mpc85xx_l2_err_probe(struct platform_device *op)
 	}
 
 	if (edac_op_state == EDAC_OPSTATE_INT) {
-		pdata->irq = irq_of_parse_and_map(op->dev.of_node, 0);
-		res = devm_request_irq(&op->dev, pdata->irq,
+		pdata->irq = platform_get_irq(op, 0);
+		if (pdata->irq < 0) {
+			res = pdata->irq;
+			goto err2;
+		}
+
+		res = request_irq(pdata->irq,
 				       mpc85xx_l2_isr, IRQF_SHARED,
 				       "[EDAC] L2 err", edac_dev);
 		if (res < 0) {
 			pr_err("%s: Unable to request irq %d for MPC85xx L2 err\n",
 				__func__, pdata->irq);
-			irq_dispose_mapping(pdata->irq);
 			res = -ENODEV;
 			goto err2;
 		}
@@ -597,7 +608,7 @@ static void mpc85xx_l2_err_remove(struct platform_device *op)
 
 	if (edac_op_state == EDAC_OPSTATE_INT) {
 		out_be32(pdata->l2_vbase + MPC85XX_L2_ERRINTEN, 0);
-		irq_dispose_mapping(pdata->irq);
+		free_irq(pdata->irq, edac_dev);
 	}
 
 	out_be32(pdata->l2_vbase + MPC85XX_L2_ERRDIS, orig_l2_err_disable);
-- 
2.55.0

Re: [PATCH] EDAC/mpc85xx: don't use devm for request_irq()

[Borislav Petkov]

On Thu, Jul 30, 2026 at 06:12:13PM -0700, Rosen Penev wrote:
> Use modern irq acquisition APIs to avoid having to call
> irq_dispose_mapping() since there's no real need to copy the mapping.
> 
> Use non devm version of request_irq() as IRQ need to be freed before
> edac_device_del_device() to avoid a use after free issue.
> 
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>  drivers/edac/mpc85xx_edac.c | 25 ++++++++++++++++++-------
>  1 file changed, 18 insertions(+), 7 deletions(-)

You were on the thread where we orphaned that driver because we have no hw to
test it on, right?

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH] EDAC/mpc85xx: don't use devm for request_irq()

[Rosen Penev]

On Thu, Jul 30, 2026 at 7:15 PM Borislav Petkov <bp@alien8.de> wrote:
>
> On Thu, Jul 30, 2026 at 06:12:13PM -0700, Rosen Penev wrote:
> > Use modern irq acquisition APIs to avoid having to call
> > irq_dispose_mapping() since there's no real need to copy the mapping.
> >
> > Use non devm version of request_irq() as IRQ need to be freed before
> > edac_device_del_device() to avoid a use after free issue.
> >
> > Signed-off-by: Rosen Penev <rosenp@gmail.com>
> > ---
> >  drivers/edac/mpc85xx_edac.c | 25 ++++++++++++++++++-------
> >  1 file changed, 18 insertions(+), 7 deletions(-)
>
> You were on the thread where we orphaned that driver because we have no hw to
> test it on, right?
yes.

For whatever reason, sashiko flagged this in a different driver

https://sashiko.dev/#/patchset/20260719194009.117532-1-rosenp%40gmail.com
>
> --
> Regards/Gruss,
>     Boris.
>
> https://people.kernel.org/tglx/notes-about-netiquette