From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1BC01477E52; Fri, 14 Aug 2026 15:30:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786721439; cv=none; b=LLRU83A1GbVS/bdGSA6AOARKZm8s+r7i+d+mCZcbE71X9wZKTF8eQx0PNKin1oUyAQVJYD73PJsKpmCwEztokpbUauRnBgolMsXNuKJOtofPQ2VTSYRZ+kkCBp/xFKK6f6Mrklu6kJ2W0TLYNmAh3fAmTyKzCpA0Nr/Eob/Px7Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786721439; c=relaxed/simple; bh=w/F6EUWInCDoIMznmphsS9M1s2ZoCn/x+NHu8DjW958=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=uouWS6754cwPEmuHvn9nPVgfOke2BQKRL4zXtv3K6VvaXKA8vyAKiWf/drf4TdZIi/zY8evBskRd7J4m4eg5O6lb0f5i31eK305shn8pA68EIQBzo56LynH3uKL7ITDX15z3KzA5bkmMdKkdYc0bpffInm3drqILI+MvjKCxAH0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=YioLex2y; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="YioLex2y" Received: from LAPTOP-99KJFSET (unknown [43.138.0.3]) by smtp.qiye.163.com (Hmail) with ESMTP id 4a0958bdb; Fri, 14 Aug 2026 23:30:21 +0800 (GMT+08:00) From: Hongyan Xu To: Lee Jones Cc: Support Opensource , mfd@lists.linux.dev, linux-kernel@vger.kernel.org, stable@vger.kernel.org, jianhao.xu@seu.edu.cn, Hongyan Xu Subject: [PATCH v3] mfd: da903x: cancel IRQ work during teardown Date: Fri, 14 Aug 2026 23:30:19 +0800 Message-ID: <20260814153019.1114-1-getshell@seu.edu.cn> X-Mailer: git-send-email 2.50.1.windows.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-HM-Tid: 0aa000e5470b03a1kunmfe537a8862a3f X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUtXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkaH0xPVhpPSEgZTx1JSk8aTVYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlPSFVKSENVS1VIWVdZFhoPEhUdFFlBWUtVS1VLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=YioLex2ywmhpxWZHP8E8mZYVsYGPsrePA1CGeZVUOhRZNTuKz7ECBaBa1nMOZNpvGhW/a9SQArpal0QkMVn2diP1GkKN7U4AbE6Xafm17KBSMNmjok48rZJV/I6xLSUmdY4uYhkyUGbC7XvIPqMUTaEnruKB0oszu3nVqPn2bQY=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=nRVGrPhZevmXUqrEu65sTEJd50zHUS9/8OzpXIKey4M=; h=date:mime-version:subject:message-id:from; The IRQ handler disables the IRQ and schedules irq_work. Releasing the IRQ does not drain that work, which can continue to use the devm-allocated chip and notifier state. Manage both IRQ-work cancellation and subdevice removal with devres. Register the subdevice-removal action before requesting the IRQ, then add the IRQ-work action after the request. This avoids leaving a live IRQ without work cancellation if action registration fails. Devres cleanup then disables the IRQ and drains the work before releasing the IRQ and removing child devices. Register both actions before creating the children so partial probe failures use the same ordering. This issue was found by the author's in-house static analysis tool. The patch was reviewed by the author against the latest mainline tree. Fixes: 26b8f5e1e2d1 ("mfd: add base support for Dialog DA9030/DA9034 PMICs") Cc: stable@vger.kernel.org Suggested-by: Lee Jones Assisted-by: Codex:GPT-5 Signed-off-by: Hongyan Xu --- Changes in v3: - Manage subdevice removal with devres and drop the remove callback. - Register its action before IRQ acquisition, then register IRQ-work cancellation after it, covering action and partial-probe failures. drivers/mfd/da903x.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c index e86b39de3303..e4ad48e1f139 100644 --- a/drivers/mfd/da903x.c +++ b/drivers/mfd/da903x.c @@ -421,6 +421,14 @@ static irqreturn_t da903x_irq_handler(int irq, void *data) return IRQ_HANDLED; } +static void da903x_cancel_irq_work(void *data) +{ + struct da903x_chip *chip = data; + + disable_irq(chip->client->irq); + cancel_work_sync(&chip->irq_work); +} + static const struct da903x_chip_ops da903x_ops[] = { [0] = { .init_chip = da9030_init_chip, @@ -456,6 +464,13 @@ static int da903x_remove_subdevs(struct da903x_chip *chip) return device_for_each_child(chip->dev, NULL, __remove_subdev); } +static void da903x_remove_subdevs_action(void *data) +{ + struct da903x_chip *chip = data; + + da903x_remove_subdevs(chip); +} + static int da903x_add_subdevs(struct da903x_chip *chip, struct da903x_platform_data *pdata) { @@ -484,7 +499,6 @@ static int da903x_add_subdevs(struct da903x_chip *chip, return 0; failed: - da903x_remove_subdevs(chip); return ret; } @@ -520,6 +534,11 @@ static int da903x_probe(struct i2c_client *client) chip->ops->mask_events(chip, chip->events_mask); chip->ops->read_events(chip, &tmp); + ret = devm_add_action_or_reset(&client->dev, + da903x_remove_subdevs_action, chip); + if (ret) + return ret; + ret = devm_request_irq(&client->dev, client->irq, da903x_irq_handler, IRQF_TRIGGER_FALLING, "da903x", chip); @@ -529,14 +548,12 @@ static int da903x_probe(struct i2c_client *client) return ret; } - return da903x_add_subdevs(chip, pdata); -} - -static void da903x_remove(struct i2c_client *client) -{ - struct da903x_chip *chip = i2c_get_clientdata(client); + ret = devm_add_action_or_reset(&client->dev, da903x_cancel_irq_work, + chip); + if (ret) + return ret; - da903x_remove_subdevs(chip); + return da903x_add_subdevs(chip, pdata); } static struct i2c_driver da903x_driver = { @@ -544,7 +561,6 @@ static struct i2c_driver da903x_driver = { .name = "da903x", }, .probe = da903x_probe, - .remove = da903x_remove, .id_table = da903x_id_table, }; -- 2.50.1.windows.1