[PATCH] rtc: pxa: fix IRQ leak on probe failure after pxa_rtc_open()

[PATCH] rtc: pxa: fix IRQ leak on probe failure after pxa_rtc_open()

[Cong Nguyen]

pxa_rtc_probe() calls pxa_rtc_open(dev), discarding its return value.
On success that requests both the 1Hz and alarm IRQs. If a later step
fails (sa1100_rtc_init() or devm_rtc_device_register()), probe returns
without releasing them -- and pxa_rtc_irq() then dereferences the
devm-freed pxa_rtc on any pending/spurious interrupt, plus a retry
fails with -EBUSY since the IRQs are never released. Not theoretical:
commit 34127b3632b2 ("rtc: pxa: fix null pointer dereference") documents
sa1100_rtc_init() failing this way on a real Zaurus SL-C1000.

Check pxa_rtc_open()'s return, and route both later failures through
pxa_rtc_release() via a new err_release label, mirroring the existing
remove() cleanup.

Fixes: 3cdf4ad9633e ("rtc: pxa: convert to use shared sa1100 functions")
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
---
 drivers/rtc/rtc-pxa.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/rtc/rtc-pxa.c b/drivers/rtc/rtc-pxa.c
index 62ee6b8f9bcd..e01e683c2f61 100644
--- a/drivers/rtc/rtc-pxa.c
+++ b/drivers/rtc/rtc-pxa.c
@@ -338,7 +338,9 @@ static int __init pxa_rtc_probe(struct platform_device *pdev)
 		return -ENOMEM;
 	}
 
-	pxa_rtc_open(dev);
+	ret = pxa_rtc_open(dev);
+	if (ret)
+		return ret;
 
 	sa1100_rtc->rcnr = pxa_rtc->base + 0x0;
 	sa1100_rtc->rtsr = pxa_rtc->base + 0x8;
@@ -347,7 +349,7 @@ static int __init pxa_rtc_probe(struct platform_device *pdev)
 	ret = sa1100_rtc_init(pdev, sa1100_rtc);
 	if (ret) {
 		dev_err(dev, "Unable to init SA1100 RTC sub-device\n");
-		return ret;
+		goto err_release;
 	}
 
 	rtsr_clear_bits(pxa_rtc, RTSR_PIALE | RTSR_RDALE1 | RTSR_HZE);
@@ -357,12 +359,16 @@ static int __init pxa_rtc_probe(struct platform_device *pdev)
 	if (IS_ERR(pxa_rtc->rtc)) {
 		ret = PTR_ERR(pxa_rtc->rtc);
 		dev_err(dev, "Failed to register RTC device -> %d\n", ret);
-		return ret;
+		goto err_release;
 	}
 
 	device_init_wakeup(dev, true);
 
 	return 0;
+
+err_release:
+	pxa_rtc_release(dev);
+	return ret;
 }
 
 static void __exit pxa_rtc_remove(struct platform_device *pdev)
-- 
2.25.1