[PATCH v2] iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

[PATCH v2] iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

[Fan Wu]

The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via
schedule_delayed_work(); that work is cleared by a devm callback.
Register the devm callback before devm_request_irq() so the devres LIFO
teardown frees the IRQ first, ensuring the handler can no longer queue
work by the time the workqueue is cleared. Otherwise the handler could
re-arm the work and run it after the xadc structure has been freed.

This issue was found by an in-house static analysis tool.

Fixes: 2a9685d1a3b7 ("iio: adc: xilinx: use more devres helpers and remove remove()")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---

Changes in v2: shorten the commit message and replace the multi-line code
comment with a one-line note, per review feedback from Jonathan Cameron.
The devm registration reorder (the fix) is unchanged; David Lechner's
Reviewed-by was obtained on v1.

 drivers/iio/adc/xilinx-xadc-core.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -1395,13 +1395,14 @@ static int xadc_probe(struct platform_device *pdev)
 	}

 	if (irq > 0) {
-		ret = devm_request_irq(dev, irq, xadc->ops->interrupt_handler,
-				       0, dev_name(dev), indio_dev);
+		/* Clear out any work queued by the interrupt */
+		ret = devm_add_action_or_reset(dev, xadc_cancel_delayed_work,
+					       &xadc->zynq_unmask_work);
 		if (ret)
 			return ret;

-		ret = devm_add_action_or_reset(dev, xadc_cancel_delayed_work,
-					       &xadc->zynq_unmask_work);
+		ret = devm_request_irq(dev, irq, xadc->ops->interrupt_handler,
+				       0, dev_name(dev), indio_dev);
 		if (ret)
 			return ret;
 	}
--
2.43.0

Re: [PATCH v2] iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

[Sai Krishna Potthuri]

On 8/3/2026 1:33 PM, Fan Wu wrote:
> The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via
> schedule_delayed_work(); that work is cleared by a devm callback.
> Register the devm callback before devm_request_irq() so the devres LIFO
> teardown frees the IRQ first, ensuring the handler can no longer queue
> work by the time the workqueue is cleared. Otherwise the handler could
> re-arm the work and run it after the xadc structure has been freed.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: 2a9685d1a3b7 ("iio: adc: xilinx: use more devres helpers and remove remove()")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Reviewed-by: David Lechner <dlechner@baylibre.com>
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Reviewed-by: Sai Krishna Potthuri <sai.krishna.potthuri@amd.com>

Regards
Sai Krishna


> ---
> 
> Changes in v2: shorten the commit message and replace the multi-line code
> comment with a one-line note, per review feedback from Jonathan Cameron.
> The devm registration reorder (the fix) is unchanged; David Lechner's
> Reviewed-by was obtained on v1.
> 
>   drivers/iio/adc/xilinx-xadc-core.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
> --- a/drivers/iio/adc/xilinx-xadc-core.c
> +++ b/drivers/iio/adc/xilinx-xadc-core.c
> @@ -1395,13 +1395,14 @@ static int xadc_probe(struct platform_device *pdev)
>   	}
> 
>   	if (irq > 0) {
> -		ret = devm_request_irq(dev, irq, xadc->ops->interrupt_handler,
> -				       0, dev_name(dev), indio_dev);
> +		/* Clear out any work queued by the interrupt */
> +		ret = devm_add_action_or_reset(dev, xadc_cancel_delayed_work,
> +					       &xadc->zynq_unmask_work);
>   		if (ret)
>   			return ret;
> 
> -		ret = devm_add_action_or_reset(dev, xadc_cancel_delayed_work,
> -					       &xadc->zynq_unmask_work);
> +		ret = devm_request_irq(dev, irq, xadc->ops->interrupt_handler,
> +				       0, dev_name(dev), indio_dev);
>   		if (ret)
>   			return ret;
>   	}
> --
> 2.43.0