From 268f9159ebf38a7ed134e5008e705d8ff99e1c20 Mon Sep 17 00:00:00 2001 From: Logan Gunthorpe Date: Wed, 2 Sep 2026 00:21:47 -0600 Subject: [PATCH] dmaengine: switchtec-dma: fix chan_status_irq cleanup on create() error chan_status_irq stores an MSI-X vector index, but err_exit freed it with plain free_irq() instead of pci_free_irq(), which would free the wrong Linux IRQ. The guard also treated a valid vector index of 0 as unset, skipping the free entirely in that case and leaving the handler registered against soon-to-be-freed swdma_dev. Initialize chan_status_irq to -1 and use the value being non-negative to signal when to free it with pci_free_irq(). Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.kernel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe Link: https://patch.msgid.link/20260902062153.31048-6-logang@deltatee.com Signed-off-by: Vinod Koul --- drivers/dma/switchtec_dma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 89c8c20fed1f..fb0bb1301e2d 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1249,6 +1249,8 @@ static int switchtec_dma_create(struct pci_dev *pdev) if (!swdma_dev) return -ENOMEM; + swdma_dev->chan_status_irq = -1; + swdma_dev->bar = ioremap(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0)); @@ -1323,8 +1325,8 @@ static int switchtec_dma_create(struct pci_dev *pdev) switchtec_dma_chans_free(swdma_dev); err_exit: - if (swdma_dev->chan_status_irq) - free_irq(swdma_dev->chan_status_irq, swdma_dev); + if (swdma_dev->chan_status_irq >= 0) + pci_free_irq(pdev, swdma_dev->chan_status_irq, swdma_dev); iounmap(swdma_dev->bar); kfree(swdma_dev);