[PATCH v2] rtc: ma35d1: fix unchecked IRQ error and IRQ-before-rtcdev ordering

[PATCH v2] rtc: ma35d1: fix unchecked IRQ error and IRQ-before-rtcdev ordering

[Cong Nguyen]

platform_get_irq()'s return goes straight into devm_request_irq()'s
unsigned int param unchecked -- a negative -EPROBE_DEFER becomes a
huge positive number, so probe fails outright instead of deferring.

The IRQ is also requested before rtc->rtcdev is allocated. devm
teardown is LIFO, so unbind or a later probe failure frees rtcdev
before the IRQ, and an alarm firing in that window has
ma35d1_rtc_interrupt() touch freed memory.

Check irq_num for a negative return, and move the IRQ request to
right after devm_rtc_allocate_device() (its irqwork is already
initialized there) and before devm_rtc_register_device(), so unbind
unregisters the device before the IRQ is freed, not after.

Fixes: dc0684adf3b6 ("rtc: Add driver for Nuvoton ma35d1 rtc controller")
Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/r/20260918161925.2639130-1-congnt264@gmail.com
Assisted-by: LLM
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
---
Changes in v2:
- Sashiko found 2 issues on v1: dev_err_probe() on the irq_num check
  duplicated platform_get_irq()'s own internal error log, dropped;
  and requesting the IRQ right before devm_rtc_register_device() still
  left a window on unbind where the device is unregistered from
  userspace after the IRQ is already freed. Moved the request earlier,
  right after devm_rtc_allocate_device() (its irqwork is already
  initialized there), so unbind unregisters the device before freeing
  the IRQ, not after.

 drivers/rtc/rtc-ma35d1.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/rtc/rtc-ma35d1.c b/drivers/rtc/rtc-ma35d1.c
index cfcfc28060f6..ae68e5c89e15 100644
--- a/drivers/rtc/rtc-ma35d1.c
+++ b/drivers/rtc/rtc-ma35d1.c
@@ -236,11 +236,8 @@ static int ma35d1_rtc_probe(struct platform_device *pdev)
 	}
 
 	rtc->irq_num = platform_get_irq(pdev, 0);
-
-	ret = devm_request_irq(&pdev->dev, rtc->irq_num, ma35d1_rtc_interrupt,
-			       IRQF_NO_SUSPEND, "ma35d1rtc", rtc);
-	if (ret)
-		return dev_err_probe(&pdev->dev, ret, "Failed to request rtc irq\n");
+	if (rtc->irq_num < 0)
+		return rtc->irq_num;
 
 	platform_set_drvdata(pdev, rtc);
 
@@ -254,6 +251,11 @@ static int ma35d1_rtc_probe(struct platform_device *pdev)
 	rtc->rtcdev->range_min = RTC_TIMESTAMP_BEGIN_2000;
 	rtc->rtcdev->range_max = RTC_TIMESTAMP_END_2099;
 
+	ret = devm_request_irq(&pdev->dev, rtc->irq_num, ma35d1_rtc_interrupt,
+			       IRQF_NO_SUSPEND, "ma35d1rtc", rtc);
+	if (ret)
+		return dev_err_probe(&pdev->dev, ret, "Failed to request rtc irq\n");
+
 	ret = devm_rtc_register_device(rtc->rtcdev);
 	if (ret)
 		return dev_err_probe(&pdev->dev, ret, "Failed to register rtc device\n");
-- 
2.25.1