[PATCH] Bluetooth: btintel_pcie: use managed IRQ teardown

[PATCH] Bluetooth: btintel_pcie: use managed IRQ teardown

[Runyu Xiao]

The PCIe driver registers its MSI-X handlers with
devm_request_threaded_irq(), but remove() uses free_irq() directly. The
devres actions then retain registrations and attempt to release them again
during device cleanup.

Use devm_free_irq() for the remove path and for already registered vectors
when a later setup request fails. This removes the managed resource at the
same time as the IRQ is released and keeps MSI-X vector teardown ordered
after IRQ ownership is gone.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/bluetooth/btintel_pcie.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 005c77a4f..f8901df7c 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -1750,7 +1750,7 @@ static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
 static int btintel_pcie_setup_irq(struct btintel_pcie_data *data)
 {
 	int err;
-	int num_irqs, i;
+	int num_irqs, i, j;
 
 	for (i = 0; i < BTINTEL_PCIE_MSIX_VEC_MAX; i++)
 		data->msix_entries[i].entry = i;
@@ -1779,6 +1779,10 @@ static int btintel_pcie_setup_irq(struct btintel_pcie_data *data)
 						KBUILD_MODNAME,
 						msix_entry);
 		if (err) {
+			for (j = 0; j < i; j++)
+				devm_free_irq(&data->pdev->dev,
+					      data->msix_entries[j].vector,
+					      &data->msix_entries[j]);
 			pci_free_irq_vectors(data->pdev);
 			data->alloc_vecs = 0;
 			return err;
@@ -3101,7 +3105,7 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
 		struct msix_entry *msix_entry;
 
 		msix_entry = &data->msix_entries[i];
-		free_irq(msix_entry->vector, msix_entry);
+		devm_free_irq(&pdev->dev, msix_entry->vector, msix_entry);
 	}
 
 	pci_free_irq_vectors(pdev);
-- 
2.34.1

Re: [PATCH] Bluetooth: btintel_pcie: use managed IRQ teardown

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 30 Sep 2026 15:44:53 +0800 you wrote:
> The PCIe driver registers its MSI-X handlers with
> devm_request_threaded_irq(), but remove() uses free_irq() directly. The
> devres actions then retain registrations and attempt to release them again
> during device cleanup.
> 
> Use devm_free_irq() for the remove path and for already registered vectors
> when a later setup request fails. This removes the managed resource at the
> same time as the IRQ is released and keeps MSI-X vector teardown ordered
> after IRQ ownership is gone.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btintel_pcie: use managed IRQ teardown
    https://git.kernel.org/bluetooth/bluetooth-next/c/25016fe8c1ed

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH] Bluetooth: btintel_pcie: use managed IRQ teardown

[Ravindra]

Hi Runyu,

Thanks for the fix.

I have tested this patch with repeated Bluetooth load/unload cycles on
an Intel PCIe Bluetooth device and did not observe any kernel warnings
or issues with the patch applied.

Tested-by: Ravindra <ravindra@intel.com>

Could you please send a v2 including the above Tested-by tag?

Thanks,
Ravindra

Re: [PATCH] Bluetooth: btintel_pcie: use managed IRQ teardown

[Runyu Xiao]

On Mon, 5 Oct 2026 09:44:57 +0530, Ravindra wrote:
> I have tested this patch with repeated Bluetooth load/unload cycles on
> an Intel PCIe Bluetooth device and did not observe any kernel warnings
> or issues with the patch applied.
>
> Tested-by: Ravindra <ravindra@intel.com>
>
> Could you please send a v2 including the above Tested-by tag?

Thanks for testing this patch. I'll send a v2 shortly with your
Tested-by tag.

Thanks,
Runyu

[PATCH v2] Bluetooth: btintel_pcie: use managed IRQ teardown

[Runyu Xiao]

The PCIe driver registers its MSI-X handlers with
devm_request_threaded_irq(), but remove() uses free_irq() directly. The
devres actions then retain registrations and attempt to release them again
during device cleanup.

Use devm_free_irq() for the remove path and for already registered vectors
when a later setup request fails. This removes the managed resource at the
same time as the IRQ is released and keeps MSI-X vector teardown ordered
after IRQ ownership is gone.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Cc: stable@vger.kernel.org
Tested-by: Ravindra <ravindra@intel.com>
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
Changes in v2:
- Add Ravindra's Tested-by tag.

 drivers/bluetooth/btintel_pcie.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 005c77a4f..f8901df7c 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -1750,7 +1750,7 @@ static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
 static int btintel_pcie_setup_irq(struct btintel_pcie_data *data)
 {
 	int err;
-	int num_irqs, i;
+	int num_irqs, i, j;
 
 	for (i = 0; i < BTINTEL_PCIE_MSIX_VEC_MAX; i++)
 		data->msix_entries[i].entry = i;
@@ -1779,6 +1779,10 @@ static int btintel_pcie_setup_irq(struct btintel_pcie_data *data)
 						KBUILD_MODNAME,
 						msix_entry);
 		if (err) {
+			for (j = 0; j < i; j++)
+				devm_free_irq(&data->pdev->dev,
+					      data->msix_entries[j].vector,
+					      &data->msix_entries[j]);
 			pci_free_irq_vectors(data->pdev);
 			data->alloc_vecs = 0;
 			return err;
@@ -3101,7 +3105,7 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
 		struct msix_entry *msix_entry;
 
 		msix_entry = &data->msix_entries[i];
-		free_irq(msix_entry->vector, msix_entry);
+		devm_free_irq(&pdev->dev, msix_entry->vector, msix_entry);
 	}
 
 	pci_free_irq_vectors(pdev);
-- 
2.34.1

Re: [PATCH v2] Bluetooth: btintel_pcie: use managed IRQ teardown

[Luiz Augusto von Dentz]

Hi Runyu,

On Tue, Oct 6, 2026 at 5:56 AM Runyu Xiao <runyu.xiao@seu.edu.cn> wrote:
>
> The PCIe driver registers its MSI-X handlers with
> devm_request_threaded_irq(), but remove() uses free_irq() directly. The
> devres actions then retain registrations and attempt to release them again
> during device cleanup.
>
> Use devm_free_irq() for the remove path and for already registered vectors
> when a later setup request fails. This removes the managed resource at the
> same time as the IRQ is released and keeps MSI-X vector teardown ordered
> after IRQ ownership is gone.
>
> Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
> Cc: stable@vger.kernel.org
> Tested-by: Ravindra <ravindra@intel.com>
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
> Changes in v2:
> - Add Ravindra's Tested-by tag.

v1 has already been applied.

>
>  drivers/bluetooth/btintel_pcie.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 005c77a4f..f8901df7c 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -1750,7 +1750,7 @@ static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
>  static int btintel_pcie_setup_irq(struct btintel_pcie_data *data)
>  {
>         int err;
> -       int num_irqs, i;
> +       int num_irqs, i, j;
>
>         for (i = 0; i < BTINTEL_PCIE_MSIX_VEC_MAX; i++)
>                 data->msix_entries[i].entry = i;
> @@ -1779,6 +1779,10 @@ static int btintel_pcie_setup_irq(struct btintel_pcie_data *data)
>                                                 KBUILD_MODNAME,
>                                                 msix_entry);
>                 if (err) {
> +                       for (j = 0; j < i; j++)
> +                               devm_free_irq(&data->pdev->dev,
> +                                             data->msix_entries[j].vector,
> +                                             &data->msix_entries[j]);
>                         pci_free_irq_vectors(data->pdev);
>                         data->alloc_vecs = 0;
>                         return err;
> @@ -3101,7 +3105,7 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
>                 struct msix_entry *msix_entry;
>
>                 msix_entry = &data->msix_entries[i];
> -               free_irq(msix_entry->vector, msix_entry);
> +               devm_free_irq(&pdev->dev, msix_entry->vector, msix_entry);
>         }
>
>         pci_free_irq_vectors(pdev);
> --
> 2.34.1



-- 
Luiz Augusto von Dentz