qcom_ipcc_probe() uses a function-static int id incremented with
plain id++ to generate unique IRQ names. Under async or deferred
probe, two instances can probe concurrently and read the same value
before either increments, producing duplicate IRQ names.
The device already has a unique name assigned by the platform bus. Use
dev_name(&pdev->dev) directly as the IRQ name. This eliminates the racy
counter, the name buffer, and the devm_kasprintf() allocation entirely,
while providing a more informative IRQ name in /proc/interrupts.
Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
---
drivers/mailbox/qcom-ipcc.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/mailbox/qcom-ipcc.c b/drivers/mailbox/qcom-ipcc.c
index 185b63f724d4..456596569bb5 100644
--- a/drivers/mailbox/qcom-ipcc.c
+++ b/drivers/mailbox/qcom-ipcc.c
@@ -282,8 +282,6 @@ static int qcom_ipcc_probe(struct platform_device *pdev)
{
struct qcom_ipcc *ipcc;
u32 config_value;
- static int id;
- char *name;
int ret;
ipcc = devm_kzalloc(&pdev->dev, sizeof(*ipcc), GFP_KERNEL);
@@ -313,10 +311,6 @@ static int qcom_ipcc_probe(struct platform_device *pdev)
if (ipcc->irq < 0)
return ipcc->irq;
- name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "ipcc_%d", id++);
- if (!name)
- return -ENOMEM;
-
ipcc->irq_domain = irq_domain_create_tree(dev_fwnode(&pdev->dev), &qcom_ipcc_irq_ops, ipcc);
if (!ipcc->irq_domain)
return -ENOMEM;
@@ -327,7 +321,7 @@ static int qcom_ipcc_probe(struct platform_device *pdev)
ret = devm_request_irq(&pdev->dev, ipcc->irq, qcom_ipcc_irq_fn,
IRQF_TRIGGER_HIGH | IRQF_NO_SUSPEND |
- IRQF_NO_THREAD, name, ipcc);
+ IRQF_NO_THREAD, dev_name(&pdev->dev), ipcc);
if (ret < 0)
goto err_req_irq;
---
base-commit: 5c4d4169604b335c38bbc79bc1fc03042981fc6f
change-id: 20260921-b4-ipcc_static_id_race_upstream-2914786b5628
Best regards,
--
Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>