On Thu, Oct 15, 2026 at 10:43:00PM -0400, Myeonghun Pak wrote:
Probe requests the Linux IRQ returned by wm831x_irq(), but remove
passes the untransformed MFD IRQ resource to free_irq(). The two numbers
are not guaranteed to match. If they differ, the ON handler remains
registered and can queue polling work after the input device and driver
data have been released.
Store the requested IRQ and free it before cancelling polling work on
removal. Also cancel already queued work after free_irq() when input
registration fails; free_irq() waits for the handler but does not cancel
its work.
This issue was identified as part of our ongoing research while
reviewing kernel code.
Fixes: cd99758ba3bd ("mfd: Convert wm831x to irq_domain")
Cc: <redacted>
Assisted-by: LLM
Co-developed-by: Ijae Kim <redacted>
Signed-off-by: Ijae Kim <redacted>
Signed-off-by: Myeonghun Pak <redacted>
---
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Thanks,
Charles