Re: [PATCH v2] iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind

[Jonathan Cameron]

On Mon, 10 Aug 2026 23:27:37 +0530
Sai Krishna Potthuri <sai.krishna.potthuri@xxxxxxx> wrote:

> On 8/3/2026 1:33 PM, Fan Wu wrote:
> > The ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via
> > schedule_delayed_work(); that work is cleared by a devm callback.
> > Register the devm callback before devm_request_irq() so the devres LIFO
> > teardown frees the IRQ first, ensuring the handler can no longer queue
> > work by the time the workqueue is cleared. Otherwise the handler could
> > re-arm the work and run it after the xadc structure has been freed.
> > 
> > This issue was found by an in-house static analysis tool.
> > 
> > Fixes: 2a9685d1a3b7 ("iio: adc: xilinx: use more devres helpers and remove remove()")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: Codex:gpt-5.6
> > Reviewed-by: David Lechner <dlechner@xxxxxxxxxxxx>
> > Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>  
> 
> Reviewed-by: Sai Krishna Potthuri <sai.krishna.potthuri@xxxxxxx>
> 

Applied to the fixes-togreg branch of iio.git.

I'll be rebasing that on rc1 once available.

Thanks,

Jonathan

> Regards
> Sai Krishna
> 
> 
> > ---
> > 
> > Changes in v2: shorten the commit message and replace the multi-line code
> > comment with a one-line note, per review feedback from Jonathan Cameron.
> > The devm registration reorder (the fix) is unchanged; David Lechner's
> > Reviewed-by was obtained on v1.
> > 
> >   drivers/iio/adc/xilinx-xadc-core.c | 9 +++++----
> >   1 file changed, 5 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
> > --- a/drivers/iio/adc/xilinx-xadc-core.c
> > +++ b/drivers/iio/adc/xilinx-xadc-core.c
> > @@ -1395,13 +1395,14 @@ static int xadc_probe(struct platform_device *pdev)
> >   	}
> > 
> >   	if (irq > 0) {
> > -		ret = devm_request_irq(dev, irq, xadc->ops->interrupt_handler,
> > -				       0, dev_name(dev), indio_dev);
> > +		/* Clear out any work queued by the interrupt */
> > +		ret = devm_add_action_or_reset(dev, xadc_cancel_delayed_work,
> > +					       &xadc->zynq_unmask_work);
> >   		if (ret)
> >   			return ret;
> > 
> > -		ret = devm_add_action_or_reset(dev, xadc_cancel_delayed_work,
> > -					       &xadc->zynq_unmask_work);
> > +		ret = devm_request_irq(dev, irq, xadc->ops->interrupt_handler,
> > +				       0, dev_name(dev), indio_dev);
> >   		if (ret)
> >   			return ret;
> >   	}
> > --
> > 2.43.0  
>