[PATCH v2 0/7] hwmon: Remove redundant error messages on IRQ request failure

[PATCH v2 0/7] hwmon: Remove redundant error messages on IRQ request failure

[Pan Chuang]

Commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()") added automatic error logging to
devm_request_threaded_irq() and devm_request_any_context_irq()
via the new devm_request_result() helper, which prints device
name, IRQ number, handler functions, and error code on failure.

Since devm_request_irq() is a static inline wrapper around
devm_request_threaded_irq(), it also benefits from this
automatic logging.

Remove the now-redundant dev_err() and dev_err_probe() calls
in hwmon drivers that follow these devm_request_*_irq()
functions, as the core now provides more detailed diagnostic
information on failure.

Pan Chuang (7):
  hwmon: (axi-fan-control) Remove redundant dev_err_probe()
  hwmon: (da9055) Remove redundant dev_err()
  hwmon: (lm90) Remove redundant dev_err()
  hwmon: (npcm750-pwm-fan) Remove redundant dev_err()
  hwmon: (pwm-fan) Remove redundant dev_err()
  hwmon: (sht15) Remove redundant dev_err()
  hwmon: (pmbus) Remove redundant dev_err()

 drivers/hwmon/axi-fan-control.c  | 3 +--
 drivers/hwmon/da9055-hwmon.c     | 5 +----
 drivers/hwmon/lm90.c             | 4 +---
 drivers/hwmon/npcm750-pwm-fan.c  | 4 +---
 drivers/hwmon/pmbus/pmbus_core.c | 4 +---
 drivers/hwmon/pwm-fan.c          | 6 +-----
 drivers/hwmon/sht15.c            | 4 +---
 7 files changed, 7 insertions(+), 23 deletions(-)

-- 
2.34.1

[PATCH v2 1/7] hwmon: (axi-fan-control) Remove redundant dev_err_probe()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/hwmon/axi-fan-control.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/hwmon/axi-fan-control.c b/drivers/hwmon/axi-fan-control.c
index 1cb481a1ad26..04a767d762b3 100644
--- a/drivers/hwmon/axi-fan-control.c
+++ b/drivers/hwmon/axi-fan-control.c
@@ -508,8 +508,7 @@ static int axi_fan_control_probe(struct platform_device *pdev)
 					IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
 					NULL, ctl);
 	if (ret)
-		return dev_err_probe(&pdev->dev, ret,
-				     "failed to request an irq\n");
+		return ret;
 
 	return 0;
 }
-- 
2.34.1

[PATCH v2 2/7] hwmon: (da9055) Remove redundant dev_err()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/hwmon/da9055-hwmon.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/hwmon/da9055-hwmon.c b/drivers/hwmon/da9055-hwmon.c
index 7652d553b8ea..7d330baa0f05 100644
--- a/drivers/hwmon/da9055-hwmon.c
+++ b/drivers/hwmon/da9055-hwmon.c
@@ -256,11 +256,8 @@ static int da9055_hwmon_probe(struct platform_device *pdev)
 					NULL, da9055_auxadc_irq,
 					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
 					"adc-irq", hwmon);
-	if (ret != 0) {
-		dev_err(hwmon->da9055->dev, "DA9055 ADC IRQ failed ret=%d\n",
-			ret);
+	if (ret != 0)
 		return ret;
-	}
 
 	hwmon_dev = devm_hwmon_device_register_with_groups(dev, "da9055",
 							   hwmon,
-- 
2.34.1

[PATCH v2 3/7] hwmon: (lm90) Remove redundant dev_err()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/hwmon/lm90.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 4b9c0ccdf260..348eea5bec3f 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -2918,10 +2918,8 @@ static int lm90_probe(struct i2c_client *client)
 		err = devm_request_threaded_irq(dev, client->irq,
 						NULL, lm90_irq_thread,
 						IRQF_ONESHOT, "lm90", client);
-		if (err < 0) {
-			dev_err(dev, "cannot request IRQ %d\n", client->irq);
+		if (err < 0)
 			return err;
-		}
 	}
 
 	return 0;
-- 
2.34.1

[PATCH v2 4/7] hwmon: (npcm750-pwm-fan) Remove redundant dev_err()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs detailed
error messages on failure. Remove the now-redundant driver-specific
dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/hwmon/npcm750-pwm-fan.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/hwmon/npcm750-pwm-fan.c b/drivers/hwmon/npcm750-pwm-fan.c
index aea0b8659f5f..df24dec78e77 100644
--- a/drivers/hwmon/npcm750-pwm-fan.c
+++ b/drivers/hwmon/npcm750-pwm-fan.c
@@ -991,10 +991,8 @@ static int npcm7xx_pwm_fan_probe(struct platform_device *pdev)
 		sprintf(name, "NPCM7XX-FAN-MD%d", i);
 		ret = devm_request_irq(dev, data->fan_irq[i], npcm7xx_fan_isr,
 				       0, name, (void *)data);
-		if (ret) {
-			dev_err(dev, "register IRQ fan%d failed\n", i);
+		if (ret)
 			return ret;
-		}
 	}
 
 	for_each_child_of_node_scoped(np, child) {
-- 
2.34.1

[PATCH v2 5/7] hwmon: (pwm-fan) Remove redundant dev_err()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs detailed
error messages on failure. Remove the now-redundant driver-specific
dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/hwmon/pwm-fan.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
index 37f37813ea51..3b87f65bae05 100644
--- a/drivers/hwmon/pwm-fan.c
+++ b/drivers/hwmon/pwm-fan.c
@@ -628,12 +628,8 @@ static int pwm_fan_probe(struct platform_device *pdev)
 		if (tach->irq > 0) {
 			ret = devm_request_irq(dev, tach->irq, pulse_handler,
 					       IRQF_NO_THREAD, pdev->name, tach);
-			if (ret) {
-				dev_err(dev,
-					"Failed to request interrupt: %d\n",
-					ret);
+			if (ret)
 				return ret;
-			}
 		}
 
 		if (!ctx->pulses_per_revolution[i]) {
-- 
2.34.1

[PATCH v2 6/7] hwmon: (sht15) Remove redundant dev_err()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs detailed
error messages on failure. Remove the now-redundant driver-specific
dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/hwmon/sht15.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
index 101cebbe68e4..7bb2105d1ae2 100644
--- a/drivers/hwmon/sht15.c
+++ b/drivers/hwmon/sht15.c
@@ -981,10 +981,8 @@ static int sht15_probe(struct platform_device *pdev)
 			       IRQF_TRIGGER_FALLING,
 			       "sht15 data",
 			       data);
-	if (ret) {
-		dev_err(&pdev->dev, "failed to get irq for data line\n");
+	if (ret)
 		goto err_release_reg;
-	}
 	disable_irq_nosync(gpiod_to_irq(data->data));
 	ret = sht15_connection_reset(data);
 	if (ret)
-- 
2.34.1

[PATCH v2 7/7] hwmon: (pmbus) Remove redundant dev_err()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() call.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/hwmon/pmbus/pmbus_core.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 3143b9e0316c..91771747e2ca 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -3496,10 +3496,8 @@ static int pmbus_irq_setup(struct i2c_client *client, struct pmbus_data *data)
 	/* Register notifiers */
 	err = devm_request_threaded_irq(dev, client->irq, NULL, pmbus_fault_handler,
 					IRQF_ONESHOT, "pmbus-irq", data);
-	if (err) {
-		dev_err(dev, "failed to request an irq %d\n", err);
+	if (err)
 		return err;
-	}
 
 	return 0;
 }
-- 
2.34.1

Re: [PATCH v2 2/7] hwmon: (da9055) Remove redundant dev_err()

[sashiko-bot]

> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720063745.309331-1-panchuang@vivo.com?part=2

Re: [PATCH v2 3/7] hwmon: (lm90) Remove redundant dev_err()

[sashiko-bot]

> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720063745.309331-1-panchuang@vivo.com?part=3

Re: [PATCH v2 7/7] hwmon: (pmbus) Remove redundant dev_err()

[sashiko-bot]

> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720063745.309331-1-panchuang@vivo.com?part=7

Re: [PATCH v2 5/7] hwmon: (pwm-fan) Remove redundant dev_err()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unbalanced regulator enable count during devres cleanup if fan-shutdown-percent is set.
--

--- Patch [5]: [PATCH v2 5/7] hwmon: (pwm-fan) Remove redundant dev_err() ---
commit 1f579d7c79ca89d1d4a39ad9aa36221339e0a01b
Author: Pan Chuang <panchuang@vivo.com>

hwmon: (pwm-fan) Remove redundant dev_err()

Since devm_request_irq() automatically logs error messages on failure,
this commit removes the redundant driver-specific dev_err() call in the
probe function.

> diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
> index 37f37813ea511..3b87f65bae058 100644
> --- a/drivers/hwmon/pwm-fan.c
> +++ b/drivers/hwmon/pwm-fan.c
> @@ -628,12 +628,8 @@ static int pwm_fan_probe(struct platform_device *pdev)
>  		if (tach->irq > 0) {
>  			ret = devm_request_irq(dev, tach->irq, pulse_handler,
>  					       IRQF_NO_THREAD, pdev->name, tach);
> -			if (ret) {
> -				dev_err(dev,
> -					"Failed to request interrupt: %d\n",
> -					ret);
> +			if (ret)
>  				return ret;

[Severity: High]
This isn't a bug introduced by this patch, but does this error path trigger
an unbalanced regulator enable count if fan-shutdown-percent is set?

If devm_request_irq() fails here, devres teardown executes in reverse order.
First, pwm_fan_cleanup() runs and explicitly enables the regulator to shut
down the fan:

drivers/hwmon/pwm-fan.c:pwm_fan_cleanup() {
    ...
    if (ctx->pwm_shutdown) {
        ctx->enable_mode = pwm_enable_reg_enable;
        __set_pwm(ctx, ctx->pwm_shutdown);
    } else {
    ...
}

Later in the devres unwind, devm_regulator_release() calls regulator_put().
Because pwm_fan_cleanup() left the regulator enabled, does regulator_put()
detect a non-zero enable count and trigger a kernel warning stack trace while
leaking the reference?

>  		}
>  
>  		if (!ctx->pulses_per_revolution[i]) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720063745.309331-1-panchuang@vivo.com?part=5

Re: [PATCH v2 6/7] hwmon: (sht15) Remove redundant dev_err()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Race window during probe leads to permanently disabled IRQ and broken device measurements.
- [High] Missing cancellation of pending workqueues on probe failure and device removal leads to Use-After-Free.
--

--- Patch [6]: [PATCH v2 6/7] hwmon: (sht15) Remove redundant dev_err() ---
commit 47aa96341071db3373308927505b18391833a75b
Author: Pan Chuang <panchuang@vivo.com>

hwmon: (sht15) Remove redundant dev_err()

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs detailed
error messages on failure. Remove the now-redundant driver-specific
dev_err() call.

> diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
> index 101cebbe68e4d..7bb2105d1ae22 100644
> --- a/drivers/hwmon/sht15.c
> +++ b/drivers/hwmon/sht15.c
> @@ -981,10 +981,8 @@ static int sht15_probe(struct platform_device *pdev)
>  			       IRQF_TRIGGER_FALLING,
>  			       "sht15 data",
>  			       data);
> -	if (ret) {
> -		dev_err(&pdev->dev, "failed to get irq for data line\n");
> +	if (ret)
>  		goto err_release_reg;

[Severity: High]
This is a pre-existing issue, but does the err_release_reg error path fail
to cancel pending workqueues, potentially leading to a use-after-free?

If initialization fails here and the code jumps to err_release_reg:

sht15_probe() {
    ...
err_release_reg:
    if (!IS_ERR(data->reg)) {
        regulator_unregister_notifier(data->reg, &data->nb);
        regulator_disable(data->reg);
    }
    return ret;
}

The update_supply_work workqueue is not cancelled via cancel_work_sync().
Because the data struct is allocated with devm_kzalloc(), devres will free
it immediately when the probe fails. If the regulator notifier scheduled
update_supply_work just before the probe failed, will the pending work
execute and dereference the freed data pointer?

A similar issue appears to exist in sht15_remove(), where both read_work
and update_supply_work are left uncancelled before returning.

> -	}
>  	disable_irq_nosync(gpiod_to_irq(data->data));

[Severity: High]
This isn't a bug introduced by this patch, but is there a race window here
that could leave the IRQ permanently disabled?

Since devm_request_irq() is called without IRQF_NO_AUTOEN, the interrupt is
enabled immediately. If a falling edge occurs on the data line before the
disable_irq_nosync() call, sht15_interrupt_fired() will execute and call
disable_irq_nosync(), setting the IRQ disable depth to 1.

When sht15_probe() resumes, it will call disable_irq_nosync() again,
incrementing the disable depth to 2. Later, when a measurement starts,
enable_irq() only decrements the depth to 1. Could this cause the interrupt
to remain masked in hardware forever, breaking the driver?

>  	ret = sht15_connection_reset(data);
>  	if (ret)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720063745.309331-1-panchuang@vivo.com?part=6

Re: [PATCH v2 1/7] hwmon: (axi-fan-control) Remove redundant dev_err_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] Widespread missing 64-bit casts and unsigned logic errors across sysfs and interrupt callbacks lead to arithmetic overflows on 32-bit architectures, emitting invalid hardware configurations and garbage telemetry data.
- [High] The `fan_fault` state is concurrently accessed by the interrupt handler thread and sysfs reads without locking, directly violating the hwmon subsystem synchronization guidelines.
- [High] The hardware is left active, out of reset, and with unmasked hardware interrupts upon probe failure or module unload.
--

--- Patch [1]: [PATCH v2 1/7] hwmon: (axi-fan-control) Remove redundant dev_err_probe() ---
commit df8b06ee0f4291234f7eb4185e5e9fddf05147c5
Author: Pan Chuang <panchuang@vivo.com>

hwmon: (axi-fan-control) Remove redundant dev_err_probe()

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.

> --- a/drivers/hwmon/axi-fan-control.c
> +++ b/drivers/hwmon/axi-fan-control.c
> @@ -508,8 +508,7 @@ static int axi_fan_control_probe(struct platform_device *pdev)
>  					IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
>  					NULL, ctl);
>  	if (ret)
> -		return dev_err_probe(&pdev->dev, ret,
> -				     "failed to request an irq\n");
> +		return ret;

[Severity: High]
This is a pre-existing issue, but if devm_request_threaded_irq() fails here,
does the hardware remain active and out of reset?

axi_fan_control_init() writes to ADI_REG_IRQ_MASK to enable interrupts and
ADI_REG_RSTN to bring the hardware out of reset. If the probe fails at this
point, there doesn't seem to be any cleanup to quiesce the hardware.

There also doesn't appear to be a .remove callback to handle module unload.

[Severity: High]
This isn't a bug introduced by this patch, but do these calculations overflow
on 32-bit architectures?

drivers/hwmon/axi-fan-control.c:axi_fan_control_get_fan_rpm() {
    ...
    return DIV_ROUND_CLOSEST(60 * ctl->clk_rate, ctl->ppr * tach);
    ...
}

For standard clock rates like 100MHz, 60 * ctl->clk_rate would evaluate to
6,000,000,000, which unconditionally overflows a 32-bit unsigned integer.

Similarly, in axi_fan_control_read_temp():

drivers/hwmon/axi-fan-control.c:axi_fan_control_read_temp() {
    ...
    *val = ((raw_temp * 501374) >> 16) - 273677;
    ...
}

For 16-bit ADC values, raw_temp * 501374 exceeds 32-bit signed limits.

Additionally, in axi_fan_control_show(), if the calculated value is negative,
does the subtraction of 280230 underflow into a large positive number since it
is stored in a u32?

[Severity: High]
This is a pre-existing issue, but is there a missing lock around the fan_fault
state?

drivers/hwmon/axi-fan-control.c:axi_fan_control_read_fan() {
    ...
    *val = ctl->fan_fault;
    /* clear it now */
    ctl->fan_fault = 0;
    ...
}

If the hardware triggers an ADI_IRQ_SRC_TACH_ERR interrupt right between the
read and the clear, will the interrupt handler's update be lost?

drivers/hwmon/axi-fan-control.c:axi_fan_control_irq_handler() {
    ...
    if (irq_pending & ADI_IRQ_SRC_TACH_ERR)
        ctl->fan_fault = 1;
    ...
}

It seems this state is accessed concurrently by the interrupt handler thread
and sysfs reads without locking, which might lead to dropped fault indicators.

>  
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720063745.309331-1-panchuang@vivo.com?part=1

Re: [PATCH v2 4/7] hwmon: (npcm750-pwm-fan) Remove redundant dev_err()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:

Pre-existing issues:
- [High] The local stack array `name` is passed as the `devname` parameter to `devm_request_irq()`, resulting in a dangling pointer when the probe function returns.
- [High] The driver registers a repeating timer `data->fan_timer` but fails to cancel it when the device is unbound, leading to a use-after-free.
- [High] Missing bounds checking for Device Tree properties `reg` and `fan-tach-ch` leads to potential out-of-bounds memory accesses.
- [High] A data race exists when reading `fan_cnt` in sysfs, potentially leading to a division by zero.
- [High] The interrupt handler `npcm7xx_fan_isr` incorrectly assumes Linux virtual IRQ numbers are strictly contiguous, leading to out-of-bounds array accesses.
--

--- Patch [4]: [PATCH v2 4/7] hwmon: (npcm750-pwm-fan) Remove redundant dev_err() ---
commit ad51633ccf67c748dcb209308176241fe4d2d53b
Author: Pan Chuang <panchuang@vivo.com>

hwmon: (npcm750-pwm-fan) Remove redundant dev_err()
    
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs detailed
error messages on failure. Remove the now-redundant driver-specific
dev_err() call.

> diff --git a/drivers/hwmon/npcm750-pwm-fan.c b/drivers/hwmon/npcm750-pwm-fan.c
> index aea0b8659f5f6..df24dec78e770 100644
> --- a/drivers/hwmon/npcm750-pwm-fan.c
> +++ b/drivers/hwmon/npcm750-pwm-fan.c
> @@ -991,10 +991,8 @@ static int npcm7xx_pwm_fan_probe(struct platform_device *pdev)
>  		sprintf(name, "NPCM7XX-FAN-MD%d", i);
>  		ret = devm_request_irq(dev, data->fan_irq[i], npcm7xx_fan_isr,
>  				       0, name, (void *)data);

[Severity: High]
This is a pre-existing issue, but is it safe to use a local stack array for
the devname parameter?

devm_request_irq() stores the provided devname pointer directly in the
irqaction struct without copying the string.

Because name is a locally scoped stack array in npcm7xx_pwm_fan_probe(),
it is deallocated when the probe function returns. Subsequent reads of
/proc/interrupts could dereference this dangling pointer. Additionally,
since the same array is reused in the loop, all IRQs would share the
exact same dangling pointer.

> -		if (ret) {
> -			dev_err(dev, "register IRQ fan%d failed\n", i);
> +		if (ret)
>  			return ret;
> -		}
>  	}

While reviewing this code, I noticed a few other pre-existing issues in
the driver.

drivers/hwmon/npcm750-pwm-fan.c:npcm7xx_pwm_fan_probe() {
    ...
		timer_setup(&data->fan_timer, npcm7xx_fan_polling, 0);
		add_timer(&data->fan_timer);
    ...
}

drivers/hwmon/npcm750-pwm-fan.c:npcm7xx_pwm_fan_driver {
    static struct platform_driver npcm7xx_pwm_fan_driver = {
        .probe		= npcm7xx_pwm_fan_probe,
        .driver		= { ...
}

[Severity: High]
This isn't a bug introduced by this patch, but could data->fan_timer expire
after the driver is unbound?

The driver registers a repeating timer but fails to cancel it when the device
is unbound. The platform driver struct lacks a .remove callback, and no devm
cleanup action is registered to call del_timer_sync(). If the driver is
unbound or the module is unloaded, the devres framework will free data,
leading to a use-after-free when the timer subsequently expires.


drivers/hwmon/npcm750-pwm-fan.c:npcm7xx_en_pwm_fan() {
    ...
	ret = of_property_read_u32(child, "reg", &pwm_port);
	if (ret)
		return ret;

	data->pwm_present[pwm_port] = true;
    ...
	for (ch = 0; ch < fan_cnt; ch++) {
		index = fan_ch[ch];
		data->fan_present[index] = true;
		data->fan_dev[index].fan_st_flg = FAN_INIT;
	}
    ...
}

[Severity: High]
This is a pre-existing issue, but is it possible for a malformed device tree
to trigger an out-of-bounds memory write to data->pwm_present or data->fan_dev?

The values pwm_port and index are derived directly from the device tree and
used as indices for the fixed-size arrays data->pwm_present, data->fan_present,
and data->fan_dev. If a device tree provides values exceeding the array limits,
the driver will write out of bounds.


drivers/hwmon/npcm750-pwm-fan.c:npcm7xx_read_fan() {
    ...
		if (data->fan_dev[channel].fan_cnt > 0 &&
		    data->fan_dev[channel].fan_pls_per_rev > 0)
			*val = ((data->input_clk_freq * 60) /
				(data->fan_dev[channel].fan_cnt *
				 data->fan_dev[channel].fan_pls_per_rev));
    ...
}

drivers/hwmon/npcm750-pwm-fan.c:npcm7xx_check_cmp() {
    ...
		data->fan_dev[fan_id].fan_cnt = 0;
    ...
}

[Severity: High]
This is a pre-existing issue, but could concurrent execution lead to a
division by zero panic on data->fan_dev[channel].fan_cnt?

In npcm7xx_read_fan(), the shared variable fan_cnt is evaluated and then used
as a denominator. If the interrupt handler updates fan_cnt to 0 after the
greater-than-zero check but before the division, this would trigger a kernel
panic.


drivers/hwmon/npcm750-pwm-fan.c:npcm7xx_fan_isr() {
    ...
	module = irq - data->fan_irq[0];
	spin_lock_irqsave(&data->fan_lock[module], flags);
    ...
}

[Severity: High]
This isn't a bug introduced by this patch, but does this calculation
incorrectly assume that the irq virqs are contiguous?

Linux dynamically allocates virtual IRQ numbers, providing no guarantee that
they are allocated contiguously. If the virqs are sparse or out of order, the
calculated module index could be negative or exceed the bounds of the
fan_lock array, resulting in out-of-bounds memory corruption.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720063745.309331-1-panchuang@vivo.com?part=4

Re: [PATCH v2 1/7] hwmon: (axi-fan-control) Remove redundant dev_err_probe()

[Guenter Roeck]

On Mon, Jul 20, 2026 at 02:37:35PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() calls.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Applied.

Thanks,
Guenter

Re: [PATCH v2 2/7] hwmon: (da9055) Remove redundant dev_err()

[Guenter Roeck]

On Mon, Jul 20, 2026 at 02:37:36PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Applied.

Thanks,
Guenter

Re: [PATCH v2 3/7] hwmon: (lm90) Remove redundant dev_err()

[Guenter Roeck]

On Mon, Jul 20, 2026 at 02:37:37PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Applied.

Thanks,
Guenter

Re: [PATCH v2 4/7] hwmon: (npcm750-pwm-fan) Remove redundant dev_err()

[Guenter Roeck]

On Mon, Jul 20, 2026 at 02:37:38PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_irq() automatically logs detailed
> error messages on failure. Remove the now-redundant driver-specific
> dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Applied.

Thanks,
Guenter

Re: [PATCH v2 5/7] hwmon: (pwm-fan) Remove redundant dev_err()

[Guenter Roeck]

On Mon, Jul 20, 2026 at 02:37:39PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_irq() automatically logs detailed
> error messages on failure. Remove the now-redundant driver-specific
> dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Applied.

Thanks,
Guenter

Re: [PATCH v2 6/7] hwmon: (sht15) Remove redundant dev_err()

[Guenter Roeck]

On Mon, Jul 20, 2026 at 02:37:40PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_irq() automatically logs detailed
> error messages on failure. Remove the now-redundant driver-specific
> dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Applied.

Thanks,
Guenter

Re: [PATCH v2 7/7] hwmon: (pmbus) Remove redundant dev_err()

[Guenter Roeck]

On Mon, Jul 20, 2026 at 02:37:41PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_threaded_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() call.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>

Applied.

Thanks,
Guenter