Re: [PATCH v6 10/23] dmaengine: ste_dma40: Fix probe IRQ leak

[Frank Li <Frank.li@oss.nxp.com>]

On Thu, Sep 24, 2026 at 10:35:22AM +0200, Linus Walleij wrote:
> d40_probe() registers the hardware interrupt before several later probe
> steps that can fail. Those error paths jump to destroy_cache without
> freeing the IRQ, leaving the handler registered after probe resources have
> been released.
>
> Track successful IRQ registration and free the IRQ on later probe failure.
>
> Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3")
> Reported-by: sashiko-bot@kernel.org
> Closes: https://lore.kernel.org/dmaengine/20260618051539.15E201F000E9@smtp.kernel.org/
> Assisted-by: LLM
> Signed-off-by: Linus Walleij <linusw@kernel.org>
> ---
>  drivers/dma/ste_dma40.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
> index 85789ee7c0c9..36f4cbd4da36 100644
> --- a/drivers/dma/ste_dma40.c
> +++ b/drivers/dma/ste_dma40.c
> @@ -3718,6 +3718,7 @@ static int __init d40_probe(struct platform_device *pdev)
>  	struct resource *res;
>  	struct resource res_lcpa;
>  	int num_reserved_chans;
> +	bool irq_requested = false;
>  	u32 val;
>  	int ret;
>
> @@ -3844,6 +3845,7 @@ static int __init d40_probe(struct platform_device *pdev)
>  		d40_err(dev, "No IRQ defined\n");
>  		goto destroy_cache;
>  	}
> +	irq_requested = true;
>
>  	dma_set_max_seg_size(base->dev, STEDMA40_MAX_SEG_SIZE);
>
> @@ -3880,6 +3882,8 @@ static int __init d40_probe(struct platform_device *pdev)
>  		regulator_disable(base->lcpa_regulator);
>  		regulator_put(base->lcpa_regulator);
>  	}
> +	if (irq_requested)
> +		free_irq(base->irq, base);

suppose irq request should be last steps. use devm_request_irq(), anyways
request_irqs should be last step to avoid suspicious irq.

Frank

>
>   report_failure:
>  	d40_err(dev, "probe failed\n");
>
> --
> 2.55.0
>