The compare interrupt can queue work that accesses the IEP state and registers. The managed IRQ is released when the driver is detached, but pending or running work is not drained before the IEP resources are freed. Initialize the work with devm_work_autocancel() after its resources are ready and before requesting the IRQ. This makes devres release the IRQ, cancel the work synchronously, and then release the resources used by the handler and worker. Moving the IRQ request also ensures the handler cannot run before the platform data and register mapping are initialized. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: f18ad402cd8b ("net: ti: icss-iep: Enable compare events") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- Validated with static source review, apply checks and strict checkpatch. No build or runtime testing was performed. drivers/net/ethernet/ti/icssg/icss_iep.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/net/ethernet/ti/icssg/icss_iep.c b/drivers/net/ethernet/ti/icssg/icss_iep.c index ec085897edf090e816b05880286a3f43c69225c8..fa45538f1faa6c8b44e7dd9a4ebb7269843b60bb 100644 --- a/drivers/net/ethernet/ti/icssg/icss_iep.c +++ b/drivers/net/ethernet/ti/icssg/icss_iep.c @@ -8,6 +8,7 @@ #include #include +#include #include #include #include @@ -857,18 +858,6 @@ static int icss_iep_probe(struct platform_device *pdev) if (irq == -EPROBE_DEFER) return irq; - if (irq > 0) { - ret = devm_request_irq(dev, irq, icss_iep_cap_cmp_irq, - IRQF_TRIGGER_HIGH, "iep_cap_cmp", iep); - if (ret) { - dev_info(iep->dev, "cap_cmp irq request failed: %x\n", - ret); - } else { - iep->cap_cmp_irq = irq; - INIT_WORK(&iep->work, icss_iep_cap_cmp_work); - } - } - iep_clk = devm_clk_get(dev, NULL); if (IS_ERR(iep_clk)) return PTR_ERR(iep_clk); @@ -895,9 +884,24 @@ static int icss_iep_probe(struct platform_device *pdev) iep->ptp_info = icss_iep_ptp_info; mutex_init(&iep->ptp_clk_mutex); - dev_set_drvdata(dev, iep); icss_iep_disable(iep); + if (irq > 0) { + ret = devm_work_autocancel(dev, &iep->work, icss_iep_cap_cmp_work); + if (ret) + return ret; + + ret = devm_request_irq(dev, irq, icss_iep_cap_cmp_irq, + IRQF_TRIGGER_HIGH, "iep_cap_cmp", iep); + if (ret) + dev_info(iep->dev, "cap_cmp irq request failed: %x\n", + ret); + else + iep->cap_cmp_irq = irq; + } + + dev_set_drvdata(dev, iep); + return 0; } -- 2.47.1