dm9000_probe() requests an optional wake IRQ with the net_device as its cookie, but neither probe unwind nor removal frees it. The handler accesses the private board data and its MMIO mappings, which are released by dm9000_release_board() and free_netdev(). Track successful IRQ registration separately from wake_supported: the wake capability test can fail after request_irq() succeeds. Free the registered IRQ in the common board cleanup before unmapping registers, waiting for any running handler before releasing its resources. This covers both later probe failures and removal without freeing an IRQ whose request failed. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: c029f4440fd3 ("DM9000: Wake on LAN support") Cc: stable@vger.kernel.org Assisted-by: OpenAI:GPT-5.6 Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/net/ethernet/davicom/dm9000.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c index b87eaf0c2..c8ff07fe3 100644 --- a/drivers/net/ethernet/davicom/dm9000.c +++ b/drivers/net/ethernet/davicom/dm9000.c @@ -104,6 +104,7 @@ struct board_info { unsigned int in_timeout:1; unsigned int in_suspend:1; unsigned int wake_supported:1; + unsigned int wake_irq_requested:1; enum dm9000_type type; @@ -802,6 +803,9 @@ dm9000_poll_work(struct work_struct *w) static void dm9000_release_board(struct platform_device *pdev, struct board_info *db) { + if (db->wake_irq_requested) + free_irq(db->irq_wake, db->ndev); + /* unmap our resources */ iounmap(db->io_addr); @@ -1519,6 +1523,7 @@ dm9000_probe(struct platform_device *pdev) if (ret) { dev_err(db->dev, "cannot get wakeup irq (%d)\n", ret); } else { + db->wake_irq_requested = 1; /* test to see if irq is really wakeup capable */ ret = irq_set_irq_wake(db->irq_wake, 1);