[PATCH] Input: wm831x-on - free the mapped IRQ on removal

[PATCH] Input: wm831x-on - free the mapped IRQ on removal

[Myeonghun Pak]

Probe requests the Linux IRQ returned by wm831x_irq(), but remove
passes the untransformed MFD IRQ resource to free_irq(). The two numbers
are not guaranteed to match. If they differ, the ON handler remains
registered and can queue polling work after the input device and driver
data have been released.

Store the requested IRQ and free it before cancelling polling work on
removal. Also cancel already queued work after free_irq() when input
registration fails; free_irq() waits for the handler but does not cancel
its work.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: cd99758ba3bd ("mfd: Convert wm831x to irq_domain")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Compile-tested with GCC, W=1 (x86_64). No runtime testing.

 drivers/input/misc/wm831x-on.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/input/misc/wm831x-on.c b/drivers/input/misc/wm831x-on.c
index 18eb319..5696503 100644
--- a/drivers/input/misc/wm831x-on.c
+++ b/drivers/input/misc/wm831x-on.c
@@ -31,6 +31,7 @@ struct wm831x_on {
 	struct input_dev *dev;
 	struct delayed_work work;
 	struct wm831x *wm831x;
+	int irq;
 };
 
 /*
@@ -83,6 +84,7 @@ static int wm831x_on_probe(struct platform_device *pdev)
 	}
 
 	wm831x_on->wm831x = wm831x;
+	wm831x_on->irq = irq;
 	INIT_DELAYED_WORK(&wm831x_on->work, wm831x_poll_on);
 
 	wm831x_on->dev = devm_input_allocate_device(&pdev->dev);
@@ -118,6 +120,7 @@ static int wm831x_on_probe(struct platform_device *pdev)
 
 err_irq:
 	free_irq(irq, wm831x_on);
+	cancel_delayed_work_sync(&wm831x_on->work);
 err_input_dev:
 err:
 	return ret;
@@ -126,9 +129,8 @@ static int wm831x_on_probe(struct platform_device *pdev)
 static void wm831x_on_remove(struct platform_device *pdev)
 {
 	struct wm831x_on *wm831x_on = platform_get_drvdata(pdev);
-	int irq = platform_get_irq(pdev, 0);
 
-	free_irq(irq, wm831x_on);
+	free_irq(wm831x_on->irq, wm831x_on);
 	cancel_delayed_work_sync(&wm831x_on->work);
 }
 

Re: [PATCH] Input: wm831x-on - free the mapped IRQ on removal

[Charles Keepax]

On Thu, Oct 15, 2026 at 10:43:00PM -0400, Myeonghun Pak wrote:
> Probe requests the Linux IRQ returned by wm831x_irq(), but remove
> passes the untransformed MFD IRQ resource to free_irq(). The two numbers
> are not guaranteed to match. If they differ, the ON handler remains
> registered and can queue polling work after the input device and driver
> data have been released.
> 
> Store the requested IRQ and free it before cancelling polling work on
> removal. Also cancel already queued work after free_irq() when input
> registration fails; free_irq() waits for the handler but does not cancel
> its work.
> 
> This issue was identified as part of our ongoing research while
> reviewing kernel code.
> 
> Fixes: cd99758ba3bd ("mfd: Convert wm831x to irq_domain")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles