[PATCH 0/2] mailbox: Remove redundant mbox_controller_unregister() on probe failure

[PATCH 0/2] mailbox: Remove redundant mbox_controller_unregister() on probe failure

[Anup Vishwakarma]

Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
---
Anup Vishwakarma (2):
      mailbox: qcom-ipcc: Remove redundant mbox_controller_unregister() on probe failure
      mailbox: arm_mhu_db: Remove redundant mbox_controller_unregister() on probe failure

 drivers/mailbox/arm_mhu_db.c | 8 +++-----
 drivers/mailbox/qcom-ipcc.c  | 2 --
 2 files changed, 3 insertions(+), 7 deletions(-)
---
base-commit: bf1ee2bd5c2da8992f33c8950ef194aaff74ed6c
change-id: 20261006-b4-mbox_double_unregister_fix-42d5057d3ad5

Best regards,
--  
Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>

[PATCH 1/2] mailbox: qcom-ipcc: Remove redundant mbox_controller_unregister() on probe failure

[Anup Vishwakarma]

qcom_ipcc_probe() registers the mailbox controller via
devm_mbox_controller_register(), which automatically calls
mbox_controller_unregister() through devres when the device is removed
or probe fails. If devm_request_irq() subsequently fails, the
err_req_irq: label also manually calls mbox_controller_unregister(),
resulting in a double call that corrupts the global mailbox controller
list and causes a kernel panic.

Remove the redundant manual call and rely on devres for cleanup.

Fixes: e9d50e4b4d04 ("mailbox: qcom-ipcc: Dynamic alloc for channel arrangement")
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
---
 drivers/mailbox/qcom-ipcc.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/mailbox/qcom-ipcc.c b/drivers/mailbox/qcom-ipcc.c
index 185b63f724d4..206ad4884987 100644
--- a/drivers/mailbox/qcom-ipcc.c
+++ b/drivers/mailbox/qcom-ipcc.c
@@ -336,8 +336,6 @@ static int qcom_ipcc_probe(struct platform_device *pdev)
 	return 0;
 
 err_req_irq:
-	if (ipcc->num_chans)
-		mbox_controller_unregister(&ipcc->mbox);
 err_mbox:
 	irq_domain_remove(ipcc->irq_domain);
 

-- 
2.43.0

Re: [PATCH 1/2] mailbox: qcom-ipcc: Remove redundant mbox_controller_unregister() on probe failure

[Mukesh Ojha]

On Tue, Oct 06, 2026 at 02:44:14PM +0530, Anup Vishwakarma wrote:
> qcom_ipcc_probe() registers the mailbox controller via
> devm_mbox_controller_register(), which automatically calls
> mbox_controller_unregister() through devres when the device is removed
> or probe fails. If devm_request_irq() subsequently fails, the
> err_req_irq: label also manually calls mbox_controller_unregister(),
> resulting in a double call that corrupts the global mailbox controller
> list and causes a kernel panic.
> 
> Remove the redundant manual call and rely on devres for cleanup.
> 
> Fixes: e9d50e4b4d04 ("mailbox: qcom-ipcc: Dynamic alloc for channel arrangement")
> Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
> ---
>  drivers/mailbox/qcom-ipcc.c | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/drivers/mailbox/qcom-ipcc.c b/drivers/mailbox/qcom-ipcc.c
> index 185b63f724d4..206ad4884987 100644
> --- a/drivers/mailbox/qcom-ipcc.c
> +++ b/drivers/mailbox/qcom-ipcc.c
> @@ -336,8 +336,6 @@ static int qcom_ipcc_probe(struct platform_device *pdev)
>  	return 0;
>  
>  err_req_irq:

Get rid of label as well..

> -	if (ipcc->num_chans)
> -		mbox_controller_unregister(&ipcc->mbox);
>  err_mbox:
>  	irq_domain_remove(ipcc->irq_domain);
>  
> 

with the above fix..

Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>

-- 
-Mukesh Ojha

[PATCH 2/2] mailbox: arm_mhu_db: Remove redundant mbox_controller_unregister() on probe failure

[Anup Vishwakarma]

mhu_db_probe() registers the mailbox controller via
devm_mbox_controller_register(), which automatically calls
mbox_controller_unregister() through devres when the device is removed
or probe fails. If devm_request_threaded_irq() subsequently fails in
the channel setup loop, the error path also manually calls
mbox_controller_unregister(), resulting in a double call that corrupts
the global mailbox controller list and causes a kernel panic.

Remove the redundant manual call and rely on devres for cleanup.

Fixes: 7002ca237b21 ("mailbox: arm_mhu: Add ARM MHU doorbell driver")
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
---
 drivers/mailbox/arm_mhu_db.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/mailbox/arm_mhu_db.c b/drivers/mailbox/arm_mhu_db.c
index a39239e38a47..9668dfdedc78 100644
--- a/drivers/mailbox/arm_mhu_db.c
+++ b/drivers/mailbox/arm_mhu_db.c
@@ -315,12 +315,10 @@ static int mhu_db_probe(struct amba_device *adev, const struct amba_id *id)
 		mhu->mlink[i].tx_reg = mhu->mlink[i].rx_reg + TX_REG_OFFSET;
 
 		err = devm_request_threaded_irq(dev, irq, NULL,
-						mhu_db_mbox_rx_handler,
-						IRQF_ONESHOT, "mhu_db_link", mhu);
-		if (err) {
-			mbox_controller_unregister(&mhu->mbox);
+					mhu_db_mbox_rx_handler,
+					IRQF_ONESHOT, "mhu_db_link", mhu);
+		if (err)
 			return err;
-		}
 	}
 
 	dev_info(dev, "ARM MHU Doorbell mailbox registered\n");

-- 
2.43.0

Re: [PATCH 2/2] mailbox: arm_mhu_db: Remove redundant mbox_controller_unregister() on probe failure

[Mukesh Ojha]

On Tue, Oct 06, 2026 at 02:44:15PM +0530, Anup Vishwakarma wrote:
> mhu_db_probe() registers the mailbox controller via
> devm_mbox_controller_register(), which automatically calls
> mbox_controller_unregister() through devres when the device is removed
> or probe fails. If devm_request_threaded_irq() subsequently fails in
> the channel setup loop, the error path also manually calls
> mbox_controller_unregister(), resulting in a double call that corrupts
> the global mailbox controller list and causes a kernel panic.
> 
> Remove the redundant manual call and rely on devres for cleanup.
> 
> Fixes: 7002ca237b21 ("mailbox: arm_mhu: Add ARM MHU doorbell driver")
> Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
> ---
>  drivers/mailbox/arm_mhu_db.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/mailbox/arm_mhu_db.c b/drivers/mailbox/arm_mhu_db.c
> index a39239e38a47..9668dfdedc78 100644
> --- a/drivers/mailbox/arm_mhu_db.c
> +++ b/drivers/mailbox/arm_mhu_db.c
> @@ -315,12 +315,10 @@ static int mhu_db_probe(struct amba_device *adev, const struct amba_id *id)
>  		mhu->mlink[i].tx_reg = mhu->mlink[i].rx_reg + TX_REG_OFFSET;
>  
>  		err = devm_request_threaded_irq(dev, irq, NULL,
> -						mhu_db_mbox_rx_handler,
> -						IRQF_ONESHOT, "mhu_db_link", mhu);
> -		if (err) {
> -			mbox_controller_unregister(&mhu->mbox);
> +					mhu_db_mbox_rx_handler,
> +					IRQF_ONESHOT, "mhu_db_link", mhu);

It looks like alignment/indentation is unnecessary changing.

> +		if (err)
>  			return err;
> -		}
>  	}

with the above fix.

Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>

-- 
-Mukesh Ojha

Re: [PATCH 2/2] mailbox: arm_mhu_db: Remove redundant mbox_controller_unregister() on probe failure

[Anup Vishwakarma]

On 10/6/2026 3:00 PM, Mukesh Ojha wrote:
> On Tue, Oct 06, 2026 at 02:44:15PM +0530, Anup Vishwakarma wrote:
>> mhu_db_probe() registers the mailbox controller via
>> devm_mbox_controller_register(), which automatically calls
>> mbox_controller_unregister() through devres when the device is removed
>> or probe fails. If devm_request_threaded_irq() subsequently fails in
>> the channel setup loop, the error path also manually calls
>> mbox_controller_unregister(), resulting in a double call that corrupts
>> the global mailbox controller list and causes a kernel panic.
>>
>> Remove the redundant manual call and rely on devres for cleanup.
>>
>> Fixes: 7002ca237b21 ("mailbox: arm_mhu: Add ARM MHU doorbell driver")
>> Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
>> ---
>>   drivers/mailbox/arm_mhu_db.c | 8 +++-----
>>   1 file changed, 3 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/mailbox/arm_mhu_db.c b/drivers/mailbox/arm_mhu_db.c
>> index a39239e38a47..9668dfdedc78 100644
>> --- a/drivers/mailbox/arm_mhu_db.c
>> +++ b/drivers/mailbox/arm_mhu_db.c
>> @@ -315,12 +315,10 @@ static int mhu_db_probe(struct amba_device *adev, const struct amba_id *id)
>>   		mhu->mlink[i].tx_reg = mhu->mlink[i].rx_reg + TX_REG_OFFSET;
>>   
>>   		err = devm_request_threaded_irq(dev, irq, NULL,
>> -						mhu_db_mbox_rx_handler,
>> -						IRQF_ONESHOT, "mhu_db_link", mhu);
>> -		if (err) {
>> -			mbox_controller_unregister(&mhu->mbox);
>> +					mhu_db_mbox_rx_handler,
>> +					IRQF_ONESHOT, "mhu_db_link", mhu);
> It looks like alignment/indentation is unnecessary changing.
>
>> +		if (err)
>>   			return err;
>> -		}
>>   	}
> with the above fix.
>
> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>

Thanks for the review, Mukesh. Addressed both comments in v2: - Removed 
the now-empty err_req_irq: label in qcom-ipcc.c - Restored original 
alignment of devm_request_threaded_irq() arguments in arm_mhu_db.c

Best Regards, Anup Vishwakarma

Re: [PATCH 0/2] mailbox: Remove redundant mbox_controller_unregister() on probe failure

[Mukesh Ojha]

On Tue, Oct 06, 2026 at 02:44:13PM +0530, Anup Vishwakarma wrote:
> Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>


Avoid sending cover-letter if there is nothing in it.

> ---
> Anup Vishwakarma (2):
>       mailbox: qcom-ipcc: Remove redundant mbox_controller_unregister() on probe failure
>       mailbox: arm_mhu_db: Remove redundant mbox_controller_unregister() on probe failure
> 
>  drivers/mailbox/arm_mhu_db.c | 8 +++-----
>  drivers/mailbox/qcom-ipcc.c  | 2 --
>  2 files changed, 3 insertions(+), 7 deletions(-)
> ---
> base-commit: bf1ee2bd5c2da8992f33c8950ef194aaff74ed6c
> change-id: 20261006-b4-mbox_double_unregister_fix-42d5057d3ad5
> 
> Best regards,
> --  
> Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
> 

-- 
-Mukesh Ojha