[BUG] free_irq -- mei_me_probe error path frees an IRQ it never acquired

[BUG] free_irq -- mei_me_probe error path frees an IRQ it never acquired

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/130-mei_me-free_irq-never-acquired/

  genirq: Flags mismatch irq 0. 00000080 (mei_me) vs. 00215a00 (timer)
  mei_me 0000:00:01.0: request_threaded_irq failure. irq = 0
  Trying to free already-free IRQ 0
  WARNING: kernel/irq/manage.c:1879 at __free_irq
kernel/irq/manage.c:1879 [inline], CPU#1: kworker/u10:0/27
  WARNING: kernel/irq/manage.c:1879 at free_irq+0x292/0x8b0
kernel/irq/manage.c:2018, CPU#1: kworker/u10:0/27
  Workqueue: async async_run_entry_fn
  Call Trace:
   free_irq+0x292/0x8b0 kernel/irq/manage.c:2018
   mei_me_probe+0x672/0x820 drivers/misc/mei/pci-me.c:295
   pci_device_probe+0x461/0xa50 drivers/pci/pci-driver.c:489
   really_probe+0x267/0xaf0 drivers/base/dd.c:709
   driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
   __driver_attach_async_helper+0x128/0x290 drivers/base/dd.c:1227

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] free_irq -- mei_me_probe error path frees an IRQ it never acquired

[Greg Kroah-Hartman]

On Thu, Aug 27, 2026 at 08:20:16PM -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/130-mei_me-free_irq-never-acquired/
> 
>   genirq: Flags mismatch irq 0. 00000080 (mei_me) vs. 00215a00 (timer)
>   mei_me 0000:00:01.0: request_threaded_irq failure. irq = 0
>   Trying to free already-free IRQ 0
>   WARNING: kernel/irq/manage.c:1879 at __free_irq
> kernel/irq/manage.c:1879 [inline], CPU#1: kworker/u10:0/27
>   WARNING: kernel/irq/manage.c:1879 at free_irq+0x292/0x8b0
> kernel/irq/manage.c:2018, CPU#1: kworker/u10:0/27
>   Workqueue: async async_run_entry_fn
>   Call Trace:
>    free_irq+0x292/0x8b0 kernel/irq/manage.c:2018
>    mei_me_probe+0x672/0x820 drivers/misc/mei/pci-me.c:295
>    pci_device_probe+0x461/0xa50 drivers/pci/pci-driver.c:489
>    really_probe+0x267/0xaf0 drivers/base/dd.c:709
>    driver_probe_device+0x4f/0x240 drivers/base/dd.c:901
>    __driver_attach_async_helper+0x128/0x290 drivers/base/dd.c:1227
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.

Please send a patch to fix this, as you have a reproducer, and your tool
can generate it quite easily.

thanks,

greg k-h