[PATCH] mfd: da903x: cancel IRQ work during teardown

[PATCH] mfd: da903x: cancel IRQ work during teardown

[Hongyan Xu]

The IRQ handler disables the IRQ and schedules irq_work. Releasing the
IRQ does not drain that work, which can continue to use the devm-allocated
chip and notifier state.

Add a devm action after requesting the IRQ. The action disables the IRQ
and cancels the work before automatic IRQ release. Run the same action
before removing child devices on normal detach.

This issue was found by a static analysis tool.

Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/mfd/da903x.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
index e86b39d..fdff445 100644
--- a/drivers/mfd/da903x.c
+++ b/drivers/mfd/da903x.c
@@ -421,6 +421,14 @@ static irqreturn_t da903x_irq_handler(int irq, void *data)
 	return IRQ_HANDLED;
 }
 
+static void da903x_cancel_irq_work(void *data)
+{
+	struct da903x_chip *chip = data;
+
+	disable_irq(chip->client->irq);
+	cancel_work_sync(&chip->irq_work);
+}
+
 static const struct da903x_chip_ops da903x_ops[] = {
 	[0] = {
 		.init_chip	= da9030_init_chip,
@@ -529,6 +537,11 @@ static int da903x_probe(struct i2c_client *client)
 		return ret;
 	}
 
+	ret = devm_add_action_or_reset(&client->dev, da903x_cancel_irq_work,
+				       chip);
+	if (ret)
+		return ret;
+
 	return da903x_add_subdevs(chip, pdata);
 }
 
@@ -536,6 +549,7 @@ static void da903x_remove(struct i2c_client *client)
 {
 	struct da903x_chip *chip = i2c_get_clientdata(client);
 
+	devm_release_action(&client->dev, da903x_cancel_irq_work, chip);
 	da903x_remove_subdevs(chip);
 }
 
-- 
2.50.1.windows.1

Re: [PATCH] mfd: da903x: cancel IRQ work during teardown

[Lee Jones]

/* Sashiko Automation: Issues Found (2 Findings) */

Please review, explain or fix the Sashiko review(s).

If this is a set, this request includes the other patches too.

On Tue, 28 Jul 2026, Hongyan Xu wrote:

> The IRQ handler disables the IRQ and schedules irq_work. Releasing the
> IRQ does not drain that work, which can continue to use the devm-allocated
> chip and notifier state.
> 
> Add a devm action after requesting the IRQ. The action disables the IRQ
> and cancels the work before automatic IRQ release. Run the same action
> before removing child devices on normal detach.
> 
> This issue was found by a static analysis tool.
> 
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
>  drivers/mfd/da903x.c | 14 ++++++++++++++
>  1 file changed, 14 insertions(+)
> 
> diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
> index e86b39d..fdff445 100644
> --- a/drivers/mfd/da903x.c
> +++ b/drivers/mfd/da903x.c
> @@ -421,6 +421,14 @@ static irqreturn_t da903x_irq_handler(int irq, void *data)
>  	return IRQ_HANDLED;
>  }
>  
> +static void da903x_cancel_irq_work(void *data)
> +{
> +	struct da903x_chip *chip = data;
> +
> +	disable_irq(chip->client->irq);
> +	cancel_work_sync(&chip->irq_work);
> +}
> +
>  static const struct da903x_chip_ops da903x_ops[] = {
>  	[0] = {
>  		.init_chip	= da9030_init_chip,
> @@ -529,6 +537,11 @@ static int da903x_probe(struct i2c_client *client)
>  		return ret;
>  	}
>  
> +	ret = devm_add_action_or_reset(&client->dev, da903x_cancel_irq_work,
> +				       chip);
> +	if (ret)
> +		return ret;
> +
>  	return da903x_add_subdevs(chip, pdata);
>  }

[Severity: High]
If da903x_add_subdevs() fails, it cleans up the subdevices internally
before returning an error, leaving a window where the IRQ and workqueue
are still active.

da903x_add_subdevs() handles errors like this:
    
failed:
        da903x_remove_subdevs(chip);
        return ret;

When the error is returned to da903x_probe(), the devres unwinding will
eventually cancel the IRQ work, but the subdevices have already been
removed.

Since the teardown logic in da903x_remove() explicitly cancels the IRQ
work before removing subdevices, is there a similar race condition
during a probe failure?


>  
> @@ -536,6 +549,7 @@ static void da903x_remove(struct i2c_client *client)
>  {
>  	struct da903x_chip *chip = i2c_get_clientdata(client);
>  
> +	devm_release_action(&client->dev, da903x_cancel_irq_work, chip);
>  	da903x_remove_subdevs(chip);
>  }
>  
> -- 
> 2.50.1.windows.1

-- 
Lee Jones

[PATCH v2] mfd: da903x: cancel IRQ work during teardown

[Hongyan Xu]

The IRQ handler disables the IRQ and schedules irq_work. Releasing the
IRQ does not drain that work, which can continue to use the devm-allocated
chip and notifier state.

Add a devm action after requesting the IRQ. The action disables the IRQ
and cancels the work before automatic IRQ release. Run the same action
before removing child devices on normal detach.

If da903x_add_subdevs() fails, it removes already-created child devices
before returning from probe. Release the action explicitly before that
cleanup so the work is stopped before child-device teardown.

This issue was found by the author's in-house static analysis tool.
The patch was reviewed by the author against the latest mainline tree.

Fixes: 26b8f5e1e2d1 ("mfd: add base support for Dialog DA9030/DA9034 PMICs")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/mfd/da903x.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/mfd/da903x.c b/drivers/mfd/da903x.c
index e86b39de3303..f3e983bd21b0 100644
--- a/drivers/mfd/da903x.c
+++ b/drivers/mfd/da903x.c
@@ -421,6 +421,14 @@ static irqreturn_t da903x_irq_handler(int irq, void *data)
 	return IRQ_HANDLED;
 }
 
+static void da903x_cancel_irq_work(void *data)
+{
+	struct da903x_chip *chip = data;
+
+	disable_irq(chip->client->irq);
+	cancel_work_sync(&chip->irq_work);
+}
+
 static const struct da903x_chip_ops da903x_ops[] = {
 	[0] = {
 		.init_chip	= da9030_init_chip,
@@ -484,6 +492,7 @@ static int da903x_add_subdevs(struct da903x_chip *chip,
 	return 0;
 
 failed:
+	devm_release_action(chip->dev, da903x_cancel_irq_work, chip);
 	da903x_remove_subdevs(chip);
 	return ret;
 }
@@ -529,6 +538,11 @@ static int da903x_probe(struct i2c_client *client)
 		return ret;
 	}
 
+	ret = devm_add_action_or_reset(&client->dev, da903x_cancel_irq_work,
+				       chip);
+	if (ret)
+		return ret;
+
 	return da903x_add_subdevs(chip, pdata);
 }
 
@@ -536,6 +550,7 @@ static void da903x_remove(struct i2c_client *client)
 {
 	struct da903x_chip *chip = i2c_get_clientdata(client);
 
+	devm_release_action(&client->dev, da903x_cancel_irq_work, chip);
 	da903x_remove_subdevs(chip);
 }
 
-- 
2.50.1.windows.1