[PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[James Hilliard]

The safety IRQ is requested after the MAC and optional WoL IRQs. If its
request fails, stmmac_free_irq() frees the unregistered safety IRQ and
leaks the WoL handler. This can warn about an already-free IRQ and make
the next open fail.

Move the safety and WoL cleanup labels into reverse acquisition order.

Fixes: 5c2215167d12 ("net: stmmac: Add driver support for common safety IRQ")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
---
Changes in v2:
- Drop the claim that later per-queue IRQ failures also had broken
  cleanup; those paths already released both IRQs.
- Add Nicolai Buchwitz's Reviewed-by.
- Link to v1: https://patch.msgid.link/20260930-stmmac-irq-unwind-v1-1-0c8a053761c7@gmail.com
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index b837e8e27a35..0403d434c9b9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3799,13 +3799,13 @@ static void stmmac_free_irq(struct net_device *dev,
 			free_irq(msi->sfty_ce_irq, dev);
 		fallthrough;
 	case REQ_IRQ_ERR_SFTY_CE:
-		if (priv->wol_irq > 0 && priv->wol_irq != dev->irq)
-			free_irq(priv->wol_irq, dev);
-		fallthrough;
-	case REQ_IRQ_ERR_SFTY:
 		if (priv->sfty_irq > 0 && priv->sfty_irq != dev->irq)
 			free_irq(priv->sfty_irq, dev);
 		fallthrough;
+	case REQ_IRQ_ERR_SFTY:
+		if (priv->wol_irq > 0 && priv->wol_irq != dev->irq)
+			free_irq(priv->wol_irq, dev);
+		fallthrough;
 	case REQ_IRQ_ERR_WOL:
 		free_irq(dev->irq, dev);
 		fallthrough;

---
base-commit: d5a007b9b457c915ab1a53227e8939e4018aa97a
change-id: 20260930-stmmac-irq-unwind-0be86901638d

Best regards,
--  
James Hilliard <james.hilliard1@gmail.com>

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[James Hilliard]

On Tue, Oct 6, 2026 at 1:09 AM <netdev-bot+sinfo@kernel.org> wrote:
>
> Hi!
>
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
>
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.

This was found while reviewing the error paths for the stmmac
MTU/resume recovery series.

>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.

It was reproduced in QEMU by injecting a safety IRQ request failure.
The unwind reported "Trying to free already-free IRQ" and left the
WoL handler registered.

>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.

The affected path was tested in QEMU with mocked MAC/DMA hardware,
not on physical hardware with separate WoL and safety IRQs.

> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
>
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[Jakub Kicinski]

On Tue, 6 Oct 2026 01:14:52 -0600 James Hilliard wrote:
> > Please do not repost the series just to address the above. Instead,
> > reply to this email with the missing information, so that reviewers
> > can take it into account. If the series needs another revision for
> > other reasons, please include the information in the commit messages
> > then.

Please make sure you read this paragraph, to the end.

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[James Hilliard]

On Tue, Oct 6, 2026 at 4:52 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Tue, 6 Oct 2026 01:14:52 -0600 James Hilliard wrote:
> > > Please do not repost the series just to address the above. Instead,
> > > reply to this email with the missing information, so that reviewers
> > > can take it into account. If the series needs another revision for
> > > other reasons, please include the information in the commit messages
> > > then.
>
> Please make sure you read this paragraph, to the end.

How much detail should I be including? I had previously been told to try
and keep commit message more terse[0] and this info didn't seem particularly
useful.

Should I put this info below the --- separator so it doesn't end up in the
final commit or something like that?

[0] https://lore.kernel.org/all/CAD++jL=6Ov5BPK1naX6orzMsrJPm_g6SkdRaU6Ji+okXMFaZdQ@mail.gmail.com/

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[Andrew Lunn]

On Tue, Oct 06, 2026 at 05:17:20PM -0600, James Hilliard wrote:
> On Tue, Oct 6, 2026 at 4:52 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > On Tue, 6 Oct 2026 01:14:52 -0600 James Hilliard wrote:
> > > > Please do not repost the series just to address the above. Instead,
> > > > reply to this email with the missing information, so that reviewers
> > > > can take it into account. If the series needs another revision for
> > > > other reasons, please include the information in the commit messages
> > > > then.
> >
> > Please make sure you read this paragraph, to the end.
> 
> How much detail should I be including?

We want to decide should the patch go to net, because it is a real
problem which bothers somebody. Or is it a theoretical problem which
will never happen, so we might want net-next, or maybe /dev/null.

Sometimes it is really obvious, things like a:

Reported-by:
Tested-by: 

from the same person, makes it clear it should go to net, and it
probably is correct.

If not, a statement like:

Tested on real hardware, regression solved, no other regressions
found.

or

amd64 Compile tested only, probably broken, RFT.

or

New feature tested on real hardware.

Put yourself in our position. You are the Maintainer, what would you
want to read to know it is going to the correct tree.

     Andrew

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[James Hilliard]

On Tue, Oct 6, 2026 at 6:57 PM Andrew Lunn <andrew@lunn.ch> wrote:
>
> On Tue, Oct 06, 2026 at 05:17:20PM -0600, James Hilliard wrote:
> > On Tue, Oct 6, 2026 at 4:52 PM Jakub Kicinski <kuba@kernel.org> wrote:
> > >
> > > On Tue, 6 Oct 2026 01:14:52 -0600 James Hilliard wrote:
> > > > > Please do not repost the series just to address the above. Instead,
> > > > > reply to this email with the missing information, so that reviewers
> > > > > can take it into account. If the series needs another revision for
> > > > > other reasons, please include the information in the commit messages
> > > > > then.
> > >
> > > Please make sure you read this paragraph, to the end.
> >
> > How much detail should I be including?
>
> We want to decide should the patch go to net, because it is a real
> problem which bothers somebody. Or is it a theoretical problem which
> will never happen, so we might want net-next, or maybe /dev/null.

I mean, it's in an error handling pathway that could be hit if there's
an -ENOMEM error on an IRQ-action allocation. So it's probably
mostly a theoretical issue but I wouldn't go as far as to claim it could
never happen either as there does appear to be a plausible way to
hit it.

>
> Sometimes it is really obvious, things like a:
>
> Reported-by:
> Tested-by:
>
> from the same person, makes it clear it should go to net, and it
> probably is correct.
>
> If not, a statement like:
>
> Tested on real hardware, regression solved, no other regressions
> found.
>
> or
>
> amd64 Compile tested only, probably broken, RFT.
>
> or
>
> New feature tested on real hardware.
>
> Put yourself in our position. You are the Maintainer, what would you
> want to read to know it is going to the correct tree.

Do theoretical but still potentially reachable bug fixes go in net or net-next
generally when they haven't been reproduced on real hardware without
an artificial test harness?

I had assumed that since the commit message made it clear that this was
a bug fix and not a new feature then that would be sufficient info to know
which branch it would go in, but I guess it's not quite that simple?

>
>      Andrew
>
>

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[Andrew Lunn]

On Tue, Oct 06, 2026 at 07:27:05PM -0600, James Hilliard wrote:
> On Tue, Oct 6, 2026 at 6:57 PM Andrew Lunn <andrew@lunn.ch> wrote:
> >
> > On Tue, Oct 06, 2026 at 05:17:20PM -0600, James Hilliard wrote:
> > > On Tue, Oct 6, 2026 at 4:52 PM Jakub Kicinski <kuba@kernel.org> wrote:
> > > >
> > > > On Tue, 6 Oct 2026 01:14:52 -0600 James Hilliard wrote:
> > > > > > Please do not repost the series just to address the above. Instead,
> > > > > > reply to this email with the missing information, so that reviewers
> > > > > > can take it into account. If the series needs another revision for
> > > > > > other reasons, please include the information in the commit messages
> > > > > > then.
> > > >
> > > > Please make sure you read this paragraph, to the end.
> > >
> > > How much detail should I be including?
> >
> > We want to decide should the patch go to net, because it is a real
> > problem which bothers somebody. Or is it a theoretical problem which
> > will never happen, so we might want net-next, or maybe /dev/null.
> 
> I mean, it's in an error handling pathway that could be hit if there's
> an -ENOMEM error on an IRQ-action allocation.

ENOMEM does not happen for small allocations.

https://lwn.net/Articles/627419/

So at first glance, this seems totally theoretical, it will never
happen. So net-next, no need for a Fixes tag, etc.

	Andrew

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[Jakub Kicinski]

On Tue, 6 Oct 2026 17:17:20 -0600 James Hilliard wrote:
> > Please make sure you read this paragraph, to the end.  
> 
> How much detail should I be including? I had previously been told to try
> and keep commit message more terse[0] and this info didn't seem particularly
> useful.

Not sure how to answer this. Just think for a second -
if the information was not particularly useful, would we be asking 
for it over and over?

> Should I put this info below the --- separator so it doesn't end up in the
> final commit or something like that?

In the commit message, please, it will also be very useful
to people backporting from upstream to various downstream kernels.

Re: [PATCH net v2] net: stmmac: unwind the WoL IRQ after a safety IRQ request failure

[Maxime Chevallier]

Hi,

On 10/6/26 09:06, James Hilliard wrote:
> The safety IRQ is requested after the MAC and optional WoL IRQs. If its
> request fails, stmmac_free_irq() frees the unregistered safety IRQ and
> leaks the WoL handler. This can warn about an already-free IRQ and make
> the next open fail.
> 
> Move the safety and WoL cleanup labels into reverse acquisition order.
> 
> Fixes: 5c2215167d12 ("net: stmmac: Add driver support for common safety IRQ")
> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>

Maxime

> ---
> Changes in v2:
> - Drop the claim that later per-queue IRQ failures also had broken
>   cleanup; those paths already released both IRQs.
> - Add Nicolai Buchwitz's Reviewed-by.
> - Link to v1: https://patch.msgid.link/20260930-stmmac-irq-unwind-v1-1-0c8a053761c7@gmail.com
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index b837e8e27a35..0403d434c9b9 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -3799,13 +3799,13 @@ static void stmmac_free_irq(struct net_device *dev,
>  			free_irq(msi->sfty_ce_irq, dev);
>  		fallthrough;
>  	case REQ_IRQ_ERR_SFTY_CE:
> -		if (priv->wol_irq > 0 && priv->wol_irq != dev->irq)
> -			free_irq(priv->wol_irq, dev);
> -		fallthrough;
> -	case REQ_IRQ_ERR_SFTY:
>  		if (priv->sfty_irq > 0 && priv->sfty_irq != dev->irq)
>  			free_irq(priv->sfty_irq, dev);
>  		fallthrough;
> +	case REQ_IRQ_ERR_SFTY:
> +		if (priv->wol_irq > 0 && priv->wol_irq != dev->irq)
> +			free_irq(priv->wol_irq, dev);
> +		fallthrough;
>  	case REQ_IRQ_ERR_WOL:
>  		free_irq(dev->irq, dev);
>  		fallthrough;
> 
> ---
> base-commit: d5a007b9b457c915ab1a53227e8939e4018aa97a
> change-id: 20260930-stmmac-irq-unwind-0be86901638d
> 
> Best regards,
> --  
> James Hilliard <james.hilliard1@gmail.com>