[PATCH] Bluetooth: btintel_pcie: fix double free of IRQ in remove()

[Gongwei Li]

From: Gongwei Li <ligongwei@xxxxxxxxxx>

The MSI-X IRQs are requested with devm_request_threaded_irq() in
btintel_pcie_setup_irq(), but btintel_pcie_remove() releases them
explicitly with free_irq() and then calls pci_free_irq_vectors().

After .remove() returns, the driver core releases the remaining devm
resources of the device, which calls free_irq() a second time on the
vectors that were already freed and whose MSI-X interrupt domain has
already been destroyed by pci_free_irq_vectors(), resulting in
splats like:

  Trying to free already-free IRQ <n>

Fix this by using devm_free_irq(), which unregisters the devres
entry and then frees the IRQ, keeping the free order introduced by
the commit below intact: the IRQs are still released before
pci_free_irq_vectors() and no double free happens on devm cleanup.

Fixes: 041677e7aad6 ("Bluetooth: btintel_pcie: Fix irq leak")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Gongwei Li <ligongwei@xxxxxxxxxx>
---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 2b7231be5973..8fc4b8e3e4e1 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2966,7 +2966,7 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
 		struct msix_entry *msix_entry;
 
 		msix_entry = &data->msix_entries[i];
-		free_irq(msix_entry->vector, msix_entry);
+		devm_free_irq(&pdev->dev, msix_entry->vector, msix_entry);
 	}
 
 	pci_free_irq_vectors(pdev);
-- 
2.25.1