The devm-managed IRQ remains registered after sunxi_ir_hw_exit() stops the hardware and rc_free_device() frees the rc device. A running handler can therefore access the FIFO with clocks gated or pass a freed rc device to the raw event code. Call disable_irq() after rc_unregister_device() and before sunxi_ir_hw_exit() to wait for the handler before stopping the hardware and freeing the rc device. For backports to kernels where rc_unregister_device() frees the rc device, disable the IRQ before unregistering it. Found by a static analysis tool under development. Not tested on hardware. Fixes: b4e3e59fb59c ("[media] rc: add sunxi-ir driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20260729153104.3F6641F00AC4@smtp.kernel.org/ Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/media/rc/sunxi-cir.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c index e97bd9e03c1f..9d22ad7aa94b 100644 --- a/drivers/media/rc/sunxi-cir.c +++ b/drivers/media/rc/sunxi-cir.c @@ -374,6 +374,7 @@ static void sunxi_ir_remove(struct platform_device *pdev) struct sunxi_ir *ir = platform_get_drvdata(pdev); rc_unregister_device(ir->rc); + disable_irq(ir->irq); sunxi_ir_hw_exit(&pdev->dev); rc_free_device(ir->rc); } base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47 -- 2.43.0