Re: [PATCH] usb: gadget: m66592-udc: Free the IRQ before unmapping registers

[Aldo Ariel Panzardo]

On Fri, Oct 02, 2026 at 11:49:08PM -0400, Myeonghun Pak wrote:
> m66592_remove() unmaps the controller registers before removing its shared
> IRQ handler. Another device on the same IRQ can invoke m66592_irq() in
> that interval, and the handler reads and writes registers even when the
> controller has no enabled interrupt pending. CONFIG_DEBUG_SHIRQ can also
> invoke the handler from free_irq() after the mapping has gone away.

Confirmed against mainline: m66592_remove() calls iounmap(m66592->reg)
before free_irq(), and m66592_irq() takes m66592->lock and does register
I/O (m66592_read()/m66592_write() of INTSTS0, INTENB0, CFIFOSEL, ...)
unconditionally. request_irq() uses IRQF_SHARED, so a co-device's
interrupt -- or CONFIG_DEBUG_SHIRQ at free_irq() time -- can run the
handler against the already-unmapped mapping.

Masking the controller's interrupt sources (INTENB0 = 0) under the lock
and freeing the IRQ before iounmap() closes the window: after free_irq()
returns the handler can no longer run, and every remaining access still
happens while the MMIO mapping and private data are valid.

Reviewed-by: Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>