Re: [PATCH] Input: wm831x-on - free the mapped IRQ on removal

[Charles Keepax]

On Thu, Oct 15, 2026 at 10:43:00PM -0400, Myeonghun Pak wrote:
> Probe requests the Linux IRQ returned by wm831x_irq(), but remove
> passes the untransformed MFD IRQ resource to free_irq(). The two numbers
> are not guaranteed to match. If they differ, the ON handler remains
> registered and can queue polling work after the input device and driver
> data have been released.
> 
> Store the requested IRQ and free it before cancelling polling work on
> removal. Also cancel already queued work after free_irq() when input
> registration fails; free_irq() waits for the handler but does not cancel
> its work.
> 
> This issue was identified as part of our ongoing research while
> reviewing kernel code.
> 
> Fixes: cd99758ba3bd ("mfd: Convert wm831x to irq_domain")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
> Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
> Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
> ---

Reviewed-by: Charles Keepax <ckeepax@xxxxxxxxxxxxxxxxxxxxx>

Thanks,
Charles