Re: [PATCH net v2 1/2] net: pse-pd: stop async event sources before freeing PI data in unregister

[Kory Maincent]

On Fri, 17 Jul 2026 12:07:35 +0100
Simon Horman <horms@xxxxxxxxxx> wrote:

> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
> https://sashiko.dev/#/patchset/20260711121611.1639086-2-github@xxxxxxxxxxxx?part=1
> ---
> --- Patch [1]: [PATCH net v2 1/2] net: pse-pd: stop async event sources
> before freeing PI data in unregister --- commit
> bc4c653b9b2b42b2c22ca8b6cae3af394c8add0e Author: Carlo Szelinsky
> <github@xxxxxxxxxxxx>
> 
> net: pse-pd: stop async event sources before freeing PI data in unregister
> 
> This commit reorders the teardown process in pse_controller_unregister().
> It disables the IRQ and flushes the notification worker before flushing power
> domains and releasing the PI array. This is intended to prevent use-after-free
> issues caused by asynchronous accessors referencing freed data structures.
> 
> > diff --git a/drivers/net/pse-pd/pse_core.c b/drivers/net/pse-pd/pse_core.c
> > index a5e6d7b26b9fd..6045b6c399c26 100644
> > --- a/drivers/net/pse-pd/pse_core.c
> > +++ b/drivers/net/pse-pd/pse_core.c
> > @@ -1114,11 +1114,15 @@ EXPORT_SYMBOL_GPL(pse_controller_register);
> >   */
> >  void pse_controller_unregister(struct pse_controller_dev *pcdev)
> >  {
> > -	pse_flush_pw_ds(pcdev);
> > -	pse_release_pis(pcdev);
> > +	/* Stop the IRQ and notification worker before freeing what they
> > +	 * reach: both touch pcdev->pi, and the IRQ also uses pw_d->supply
> > +	 * that pse_flush_pw_ds() drops.
> > +	 */
> >  	if (pcdev->irq)
> >  		disable_irq(pcdev->irq);  
> 
> [Severity: High]
> Does this code call disable_irq() on an already freed IRQ line?
> 
> In tps23881.c, devm_pse_controller_register() is called before
> tps23881_setup_irq(). Because devres executes teardown actions in LIFO order,
> the IRQ is freed before pse_controller_unregister() runs.
> 
> Calling disable_irq() here operates on a freed IRQ descriptor, which can cause
> warnings or corrupt state.

This is not relevant because on the sashiko case the pcdev->irq is zero as long
as tps23881_setup_irq()->devm_pse_irq_helper() is not call, therefore the IRQ
won't be freed two times.

All others are reported as possible pre existed issues and PSE lifetime is
what you are trying to fix so on my side:

Reviewed-by: Kory Maincent <kory.maincent@xxxxxxxxxxx>

Thank you!
-- 
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com