[PATCH] mtd: rawnand: tegra: drain the IRQ before disabling the clock

[PATCH] mtd: rawnand: tegra: drain the IRQ before disabling the clock

[James Hilliard]

The managed IRQ handler remains installed until devres cleanup, after
removal or a late probe failure has suspended the controller and disabled
its clock. The handler can still be accessing registers at that point:
it signals the command and DMA completions before its final register
accesses, so waiting for a NAND operation does not drain the IRQ handler.

Mask controller interrupts and release the managed IRQ before dropping
the runtime PM reference. Apply the same ordering when chip initialization
fails after the IRQ has been requested.

Fixes: d7d9f8ec77fe ("mtd: rawnand: add NVIDIA Tegra NAND Flash controller driver")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
 drivers/mtd/nand/raw/tegra_nand.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/tegra_nand.c b/drivers/mtd/nand/raw/tegra_nand.c
index 7f9eb5f042a7..1104d75b6cbe 100644
--- a/drivers/mtd/nand/raw/tegra_nand.c
+++ b/drivers/mtd/nand/raw/tegra_nand.c
@@ -1212,10 +1212,13 @@ static int tegra_nand_probe(struct platform_device *pdev)
 
 	err = tegra_nand_chips_init(ctrl->dev, ctrl);
 	if (err)
-		goto err_put_pm;
+		goto err_free_irq;
 
 	return 0;
 
+err_free_irq:
+	writel_relaxed(0, ctrl->regs + IER);
+	devm_free_irq(ctrl->dev, ctrl->irq, ctrl);
 err_put_pm:
 	pm_runtime_put_sync_suspend(ctrl->dev);
 	pm_runtime_force_suspend(ctrl->dev);
@@ -1234,6 +1237,9 @@ static void tegra_nand_remove(struct platform_device *pdev)
 
 	nand_cleanup(chip);
 
+	writel_relaxed(0, ctrl->regs + IER);
+	devm_free_irq(ctrl->dev, ctrl->irq, ctrl);
+
 	pm_runtime_put_sync_suspend(ctrl->dev);
 	pm_runtime_force_suspend(ctrl->dev);
 }

---
base-commit: 30daaf3e7897b4a8d9b72e5b0c86dd6e2a4d7d85
change-id: 20261107-submit-tegra-nand-irq-teardown-v1-60f649303b8c

Best regards,
--  
James Hilliard <james.hilliard1@gmail.com>


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH] mtd: rawnand: tegra: drain the IRQ before disabling the clock

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] mtd: rawnand: tegra: device_node reference leak in
  tegra_nand_chips_init() [1]
--

commit 365a7f4452b91b6f2d3ef6a05d0bebfa1d8aca1e
Author: James Hilliard <james.hilliard1@gmail.com>

mtd: rawnand: tegra: drain the IRQ before disabling the clock

This commit masks controller interrupts and frees the managed IRQ before
suspending the device on driver removal and probe failure.

> diff --git a/drivers/mtd/nand/raw/tegra_nand.c b/drivers/mtd/nand/raw/tegra_nand.c
> index 7f9eb5f042a7e..1104d75b6cbe6 100644
> --- a/drivers/mtd/nand/raw/tegra_nand.c
> +++ b/drivers/mtd/nand/raw/tegra_nand.c
> @@ -1212,10 +1212,13 @@ static int tegra_nand_probe(struct platform_device *pdev)
>  
>  	err = tegra_nand_chips_init(ctrl->dev, ctrl);
>  	if (err)
> -		goto err_put_pm;
> +		goto err_free_irq;

[Severity: Medium]
This problem wasn't introduced by this patch, but does
tegra_nand_chips_init() leak the np_nand device_node reference [1]?
It acquires the child node with of_get_next_child(np, NULL) and never calls
of_node_put() on either its error paths or normal return, leaking a
reference on every probe attempt.

[1] https://sashiko.dev/#/bug/linux-3f05aa6b-f889-4376-97fb-0f7f06b4e683

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-submit-tegra-nand-irq-teardown-v1-v1-1-2c570ad4a22c@gmail.com?part=1

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/