[PATCH] Input: wm831x-on - free the mapped IRQ on removal

[PATCH] Input: wm831x-on - free the mapped IRQ on removal

[Myeonghun Pak]

Probe requests the Linux IRQ returned by wm831x_irq(), but remove
passes the untransformed MFD IRQ resource to free_irq(). The two numbers
are not guaranteed to match. If they differ, the ON handler remains
registered and can queue polling work after the input device and driver
data have been released.

Store the requested IRQ and free it before cancelling polling work on
removal. Also cancel already queued work after free_irq() when input
registration fails; free_irq() waits for the handler but does not cancel
its work.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: cd99758ba3bd ("mfd: Convert wm831x to irq_domain")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Compile-tested with GCC, W=1 (x86_64). No runtime testing.

 drivers/input/misc/wm831x-on.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/input/misc/wm831x-on.c b/drivers/input/misc/wm831x-on.c
index 18eb319..5696503 100644
--- a/drivers/input/misc/wm831x-on.c
+++ b/drivers/input/misc/wm831x-on.c
@@ -31,6 +31,7 @@ struct wm831x_on {
 	struct input_dev *dev;
 	struct delayed_work work;
 	struct wm831x *wm831x;
+	int irq;
 };
 
 /*
@@ -83,6 +84,7 @@ static int wm831x_on_probe(struct platform_device *pdev)
 	}
 
 	wm831x_on->wm831x = wm831x;
+	wm831x_on->irq = irq;
 	INIT_DELAYED_WORK(&wm831x_on->work, wm831x_poll_on);
 
 	wm831x_on->dev = devm_input_allocate_device(&pdev->dev);
@@ -118,6 +120,7 @@ static int wm831x_on_probe(struct platform_device *pdev)
 
 err_irq:
 	free_irq(irq, wm831x_on);
+	cancel_delayed_work_sync(&wm831x_on->work);
 err_input_dev:
 err:
 	return ret;
@@ -126,9 +129,8 @@ static int wm831x_on_probe(struct platform_device *pdev)
 static void wm831x_on_remove(struct platform_device *pdev)
 {
 	struct wm831x_on *wm831x_on = platform_get_drvdata(pdev);
-	int irq = platform_get_irq(pdev, 0);
 
-	free_irq(irq, wm831x_on);
+	free_irq(wm831x_on->irq, wm831x_on);
 	cancel_delayed_work_sync(&wm831x_on->work);
 }
 

Re: [PATCH] Input: wm831x-on - free the mapped IRQ on removal

[Charles Keepax]

On Thu, Oct 15, 2026 at 10:43:00PM -0400, Myeonghun Pak wrote:
> Probe requests the Linux IRQ returned by wm831x_irq(), but remove
> passes the untransformed MFD IRQ resource to free_irq(). The two numbers
> are not guaranteed to match. If they differ, the ON handler remains
> registered and can queue polling work after the input device and driver
> data have been released.
> 
> Store the requested IRQ and free it before cancelling polling work on
> removal. Also cancel already queued work after free_irq() when input
> registration fails; free_irq() waits for the handler but does not cancel
> its work.
> 
> This issue was identified as part of our ongoing research while
> reviewing kernel code.
> 
> Fixes: cd99758ba3bd ("mfd: Convert wm831x to irq_domain")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles

Re: [PATCH] Input: wm831x-on - free the mapped IRQ on removal

[Dmitry Torokhov]

Hi Myeonghun,

On Thu, Oct 15, 2026 at 10:43:00PM -0400, Myeonghun Pak wrote:
> Probe requests the Linux IRQ returned by wm831x_irq(), but remove
> passes the untransformed MFD IRQ resource to free_irq(). The two numbers
> are not guaranteed to match. If they differ, the ON handler remains
> registered and can queue polling work after the input device and driver
> data have been released.
> 
> Store the requested IRQ and free it before cancelling polling work on
> removal. Also cancel already queued work after free_irq() when input
> registration fails; free_irq() waits for the handler but does not cancel
> its work.

Why don't we switch to devm_delayed_work_autocancel() and
devm_request_irq() (or maybe use devm_request_threaded_itq() and get rid
of the delayed work)?

Also we need to get rid of wm831_irq() and make MFD give us already
mapped interrupt.

Thanks.

-- 
Dmitry