All of lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: joy.zou@oss.nxp.com
Cc: imx@lists.linux.dev, dmitry.torokhov@gmail.com,
	linux-input@vger.kernel.org, Frank.Li@kernel.org
Subject: Re: [PATCH v5 3/4] Input: snvs_pwrkey - use local device pointer to simple code
Date: Wed, 15 Jul 2026 09:38:56 +0000	[thread overview]
Message-ID: <20260715093856.A57EE1F00A3E@smtp.kernel.org> (raw)
In-Reply-To: <20260715-b4-pwrkey-v5-3-07e7353c319e@oss.nxp.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Resource Leak / Use-After-Free due to unmanaged dev_pm_set_wake_irq()
--

--- Patch [3]: [PATCH v5 3/4] Input: snvs_pwrkey - use local device pointer to simple code ---
commit a69cd5d0da1072f6e3d82c6e22dfe1b937e29159
Author: Joy Zou <joy.zou@nxp.com>

Input: snvs_pwrkey - use local device pointer to simple code

This commit introduces a local device pointer in imx_snvs_pwrkey_probe() to
simplify the code. It replaces repeated references to &pdev->dev with a
single local variable.

> diff --git a/drivers/input/keyboard/snvs_pwrkey.c b/drivers/input/keyboard/snvs_pwrkey.c
> index d58bbbe9fd58f..cbe44a38d2b3d 100644
> --- a/drivers/input/keyboard/snvs_pwrkey.c
> +++ b/drivers/input/keyboard/snvs_pwrkey.c
[ ... ]
> @@ -191,27 +192,27 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)
[ ... ]
> -	device_init_wakeup(&pdev->dev, pdata->wakeup);
> -	error = dev_pm_set_wake_irq(&pdev->dev, pdata->irq);
> +	device_init_wakeup(dev, pdata->wakeup);
> +	error = dev_pm_set_wake_irq(dev, pdata->irq);

[Severity: High]
This is a pre-existing issue, but does this code leak the wakeirq structure
when the driver is unbound?

Because the driver provides no remove callback or devm action to call
dev_pm_clear_wake_irq(), the allocated wake_irq structure appears to be left
attached to dev->power.wakeirq on unbind. If the driver is re-probed, could
this cause dev_pm_set_wake_irq() to fail with -EEXIST?

Also, since the underlying IRQ is managed by devm_request_irq() and freed on
unbind, if the system enters suspend after unbinding, could the PM core
attempt to call enable_irq_wake() using the stale, freed IRQ number and
cause an oops or use-after-free?

>  	if (error)
> -		dev_err(&pdev->dev, "irq wake enable failed.\n");
> +		dev_err(dev, "irq wake enable failed.\n");
>  
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-b4-pwrkey-v5-0-07e7353c319e@oss.nxp.com?part=3

  reply	other threads:[~2026-07-15  9:39 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-15  9:33 [PATCH v5 0/4] snvs_pwrkey - code improvements and add report event joy.zou
2026-07-15  9:33 ` [PATCH v5 1/4] Input: snvs_pwrkey - make use of dev_err_probe() joy.zou
2026-07-15  9:33 ` [PATCH v5 2/4] Input: snvs_pwrkey - propagate error code of platform_get_irq() joy.zou
2026-07-15  9:42   ` sashiko-bot
2026-07-15  9:33 ` [PATCH v5 3/4] Input: snvs_pwrkey - use local device pointer to simple code joy.zou
2026-07-15  9:38   ` sashiko-bot [this message]
2026-07-15  9:33 ` [PATCH v5 4/4] Input: snvs_pwrkey - add press event reporting to avoid event loss during suspend joy.zou
2026-07-15  9:46   ` sashiko-bot
2026-07-15 16:01   ` Frank Li

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260715093856.A57EE1F00A3E@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=Frank.Li@kernel.org \
    --cc=dmitry.torokhov@gmail.com \
    --cc=imx@lists.linux.dev \
    --cc=joy.zou@oss.nxp.com \
    --cc=linux-input@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.