[PATCH] soc: fsl: dpio: Free the IRQ before releasing the I/O object

[PATCH] soc: fsl: dpio: Free the IRQ before releasing the I/O object

[Myeonghun Pak]

The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove()
releases that object before tearing down the interrupts. The IRQ was
requested with devm_request_irq(), and unregister_dpio_irq_handlers()
only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources
to the MC resource pool without freeing the handler. An interrupt can
therefore access the freed I/O object before devres releases the IRQ.

Explicitly free the managed IRQ before returning its resource to the
pool, and perform IRQ teardown before releasing the I/O object. This
also waits for an in-flight handler while the object is still valid.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/soc/fsl/dpio/dpio-driver.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
index d5198ffc4455..fa82cdcc4922 100644
--- a/drivers/soc/fsl/dpio/dpio-driver.c
+++ b/drivers/soc/fsl/dpio/dpio-driver.c
@@ -263,6 +263,8 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev)
 static void dpio_teardown_irqs(struct fsl_mc_device *dpio_dev)
 {
 	unregister_dpio_irq_handlers(dpio_dev);
+	devm_free_irq(&dpio_dev->dev, dpio_dev->irqs[0]->virq,
+		      &dpio_dev->dev);
 	fsl_mc_free_irqs(dpio_dev);
 }
 
@@ -276,10 +278,10 @@ static void dpaa2_dpio_remove(struct fsl_mc_device *dpio_dev)
 	priv = dev_get_drvdata(dev);
 	cpu = dpaa2_io_get_cpu(priv->io);
 
-	dpaa2_io_down(priv->io);
-
 	dpio_teardown_irqs(dpio_dev);
 
+	dpaa2_io_down(priv->io);
+
 	cpumask_set_cpu(cpu, cpus_unused_mask);
 
 	err = dpio_open(dpio_dev->mc_io, 0, dpio_dev->obj_desc.id,
-- 
2.47.1

Re: [PATCH] soc: fsl: dpio: Free the IRQ before releasing the I/O object

[Ioana Ciornei]

On Thu, Sep 17, 2026 at 04:01:36PM -0400, Myeonghun Pak wrote:
> The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove()
> releases that object before tearing down the interrupts. The IRQ was
> requested with devm_request_irq(), and unregister_dpio_irq_handlers()
> only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources
> to the MC resource pool without freeing the handler. An interrupt can
> therefore access the freed I/O object before devres releases the IRQ.
> 
> Explicitly free the managed IRQ before returning its resource to the
> pool, and perform IRQ teardown before releasing the I/O object. This
> also waits for an in-flight handler while the object is still valid.
> 
> This issue was identified during our ongoing static-analysis research
> while reviewing kernel code.
> 
> Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver")
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
>  drivers/soc/fsl/dpio/dpio-driver.c |    6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
> index d5198ffc4455..fa82cdcc4922 100644
> --- a/drivers/soc/fsl/dpio/dpio-driver.c
> +++ b/drivers/soc/fsl/dpio/dpio-driver.c
> @@ -263,6 +263,8 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev)
>  static void dpio_teardown_irqs(struct fsl_mc_device *dpio_dev)
>  {
>  	unregister_dpio_irq_handlers(dpio_dev);
> +	devm_free_irq(&dpio_dev->dev, dpio_dev->irqs[0]->virq,
> +		      &dpio_dev->dev);


I would suggest moving the devm_free_irq() call inside
unregister_dpio_irq_handlers() so that we keep the register_ and
unregister_ in sync.

Thanks,
Ioana

Re: [PATCH] soc: fsl: dpio: Free the IRQ before releasing the I/O object

[Myeonghun Pak]

Hi Ioana,

Thanks for the suggestion. I've moved devm_free_irq() into
unregister_dpio_irq_handlers() to keep registration and unregistration
in sync.

I'll resend both fixes as a two-patch v2 series, with the probe
error-path cleanup first. That removes the unnecessary unregister call
before the second patch adds the managed IRQ release.

Thanks,
Myeonghun


2026년 10월 2일 (금) 오전 6:44, Ioana Ciornei <ioana.ciornei@nxp.com>님이 작성:
>
> On Thu, Sep 17, 2026 at 04:01:36PM -0400, Myeonghun Pak wrote:
> > The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove()
> > releases that object before tearing down the interrupts. The IRQ was
> > requested with devm_request_irq(), and unregister_dpio_irq_handlers()
> > only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources
> > to the MC resource pool without freeing the handler. An interrupt can
> > therefore access the freed I/O object before devres releases the IRQ.
> >
> > Explicitly free the managed IRQ before returning its resource to the
> > pool, and perform IRQ teardown before releasing the I/O object. This
> > also waits for an in-flight handler while the object is still valid.
> >
> > This issue was identified during our ongoing static-analysis research
> > while reviewing kernel code.
> >
> > Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver")
> > Assisted-by: LLM
> > Co-developed-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> > ---
> >  drivers/soc/fsl/dpio/dpio-driver.c |    6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
> > index d5198ffc4455..fa82cdcc4922 100644
> > --- a/drivers/soc/fsl/dpio/dpio-driver.c
> > +++ b/drivers/soc/fsl/dpio/dpio-driver.c
> > @@ -263,6 +263,8 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev)
> >  static void dpio_teardown_irqs(struct fsl_mc_device *dpio_dev)
> >  {
> >       unregister_dpio_irq_handlers(dpio_dev);
> > +     devm_free_irq(&dpio_dev->dev, dpio_dev->irqs[0]->virq,
> > +                   &dpio_dev->dev);
>
>
> I would suggest moving the devm_free_irq() call inside
> unregister_dpio_irq_handlers() so that we keep the register_ and
> unregister_ in sync.
>
> Thanks,
> Ioana