[PATCH RESEND 0/5] mfd: Fix an out-of-bounds IRQ map and error-path bugs

[PATCH RESEND 0/5] mfd: Fix an out-of-bounds IRQ map and error-path bugs

[shao.mingyin]

Five independent fixes in the MFD core address an out-of-bounds IRQ-map
lookup, an uninitialized interrupt-mask write, an IRQ leak on a failed
probe, a missing IRQ-wake teardown on removal, and two unchecked
firmware CRC reads.  Each patch touches a different driver; they are
grouped only because they go through the same MFD tree.  Every patch is
independent and can be applied and reviewed on its own, and taking a
subset is fine.

The series is ordered by severity:

  1/5 mfd: tps65219: Fix out-of-bounds access in tps65214 IRQ map
  2/5 mfd: twl6030-irq: Don't write garbage to interrupt mask on read failure
  3/5 mfd: arizona: Free info IRQs on probe failure
  4/5 mfd: da9052: Disable IRQ wake on device removal
  5/5 mfd: gateworks-gsc: Check firmware CRC reads for errors

1/5 adds the missing reserved-bit placeholder so that a power-button
interrupt no longer indexes past tps65214_sub_irq_offsets[].  2/5
returns the I2C read error instead of writing uninitialized stack data
to the PMIC interrupt mask.  3/5 frees the three informational IRQs
before arizona_irq_exit() tears down their domain.  4/5 tracks whether
enable_irq_wake() succeeded and disables it on the probe failure and
removal paths.  5/5 checks the two GSC_FW_CRC reads and fails the probe
instead of printing a stale CRC.

No dependencies; all five apply directly on next-20261030.

This is a resend: the copies of 1/5 and 2/5 that reached the list lost
their final empty context line in transit, so they do not apply with
git am.  The patches are unchanged; the git signature trailer is kept
so the line survives.

Shao Mingyin (5):
  mfd: tps65219: Fix out-of-bounds access in tps65214 IRQ map
  mfd: twl6030-irq: Don't write garbage to interrupt mask on read failure
  mfd: arizona: Free info IRQs on probe failure
  mfd: da9052: Disable IRQ wake on device removal
  mfd: gateworks-gsc: Check firmware CRC reads for errors

 drivers/mfd/arizona-core.c        |  3 +++
 drivers/mfd/da9052-irq.c          | 11 ++++++++++-
 drivers/mfd/gateworks-gsc.c       |  6 ++++--
 drivers/mfd/tps65219.c            |  1 +
 drivers/mfd/twl6030-irq.c         | 10 ++++++----
 include/linux/mfd/da9052/da9052.h |  2 ++
 6 files changed, 26 insertions(+), 7 deletions(-)

---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c

[PATCH RESEND 1/5] mfd: tps65219: Fix out-of-bounds access in tps65214 IRQ map

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

The tps65214_sub_irq_offsets[] array has only seven entries (bits 0-5
and 7; INT_SOURCE bit 6 is reserved) while the corresponding IRQ chip
advertises num_main_status_bits = 8.  regmap-irq's read_irq_data()
indexes sub_reg_offsets with the main-status bit number, so whenever
bit 7 of INT_SOURCE is set (the power-button interrupt) it reads past
the end of the seven-element array and uses garbage offset/num_regs
values to compute status_buf indices, which can also lead to an
out-of-bounds status_buf access.

Add an empty placeholder entry for the reserved bit 6 so that the array
lines up with the bit numbering and bit 7 hits the power-button entry.

Fixes: 7947219ab1a2 ("mfd: tps65219: Add support for TI TPS65214 PMIC")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
---
Resend: the first copy of this patch lost its final empty context
line in transit; the diff below is unchanged.
diff --git a/drivers/mfd/tps65219.c b/drivers/mfd/tps65219.c
index f8c08dd86618..4f4bfc49542c 100644
--- a/drivers/mfd/tps65219.c
+++ b/drivers/mfd/tps65219.c
@@ -268,6 +268,7 @@ static const struct regmap_irq_sub_irq_map tps65214_sub_irq_offsets[] = {
 	REGMAP_IRQ_MAIN_REG_OFFSET(tps65214_bit3_offsets),
 	REGMAP_IRQ_MAIN_REG_OFFSET(tps65214_bit4_offsets),
 	REGMAP_IRQ_MAIN_REG_OFFSET(tps65214_bit5_offsets),
+	{ .num_regs = 0 },	/* INT_SOURCE bit 6 is reserved */
 	REGMAP_IRQ_MAIN_REG_OFFSET(tps65214_bit7_offsets),
 };
 
-- 
2.47.0
-- 
2.47.0

[PATCH RESEND 2/5] mfd: twl6030-irq: Don't write garbage to interrupt mask on read failure

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

twl6030_interrupt_unmask() and twl6030_interrupt_mask() ignore the return
value of the twl_i2c_read_u8() that fetches the current mask value.  When
the read fails, "unmask_value"/"mask_value" hold uninitialized stack data
which is then masked/unmasked and written back to the INT_MSK_A/B/C
registers, corrupting the interrupt mask configuration of the whole PMIC.

Bail out with the read error before touching the value or writing it back.

Fixes: e8deb28ca8e2 ("mfd: Add support for twl6030 irq framework")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
---
Resend: the first copy of this patch lost its final empty context
line in transit; the diff below is unchanged.
diff --git a/drivers/mfd/twl6030-irq.c b/drivers/mfd/twl6030-irq.c
index 0ca00f618d4d..1333c4e9cdd7 100644
--- a/drivers/mfd/twl6030-irq.c
+++ b/drivers/mfd/twl6030-irq.c
@@ -235,10 +235,11 @@ int twl6030_interrupt_unmask(u8 bit_mask, u8 offset)
 
 	ret = twl_i2c_read_u8(TWL_MODULE_PIH, &unmask_value,
 			REG_INT_STS_A + offset);
+	if (ret)
+		return ret;
 	unmask_value &= (~(bit_mask));
-	ret |= twl_i2c_write_u8(TWL_MODULE_PIH, unmask_value,
+	return twl_i2c_write_u8(TWL_MODULE_PIH, unmask_value,
 			REG_INT_STS_A + offset); /* unmask INT_MSK_A/B/C */
-	return ret;
 }
 EXPORT_SYMBOL(twl6030_interrupt_unmask);
 
@@ -249,10 +250,11 @@ int twl6030_interrupt_mask(u8 bit_mask, u8 offset)
 
 	ret = twl_i2c_read_u8(TWL_MODULE_PIH, &mask_value,
 			REG_INT_STS_A + offset);
+	if (ret)
+		return ret;
 	mask_value |= (bit_mask);
-	ret |= twl_i2c_write_u8(TWL_MODULE_PIH, mask_value,
+	return twl_i2c_write_u8(TWL_MODULE_PIH, mask_value,
 			REG_INT_STS_A + offset); /* mask INT_MSK_A/B/C */
-	return ret;
 }
 EXPORT_SYMBOL(twl6030_interrupt_mask);
 
-- 
2.47.0
-- 
2.47.0

[PATCH RESEND 3/5] mfd: arizona: Free info IRQs on probe failure

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

arizona_dev_init() registers three informational IRQs (CLKGEN error,
Overclocked and Underclocked) with arizona_request_irq() before adding
the sub-devices.  If mfd_add_devices() fails the error path only calls
arizona_irq_exit(), which frees the CTRLIF_ERR/BOOT_DONE IRQs and the
IRQ chip/domain but leaves these three requested IRQs behind; they are
freed only in arizona_dev_exit() on the normal removal path.

As a result the three threaded IRQ handlers stay registered and
irq_dispose_mapping()/irq_domain_remove() in arizona_irq_exit() act on
virtual IRQs that are still in use.  Free them in the probe failure path
too, in the same order as arizona_dev_exit().

Fixes: 3cc729869475 ("mfd: arizona: Core driver")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index 91975536d14d..37cba7047d76 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -1373,6 +1373,9 @@ int arizona_dev_init(struct arizona *arizona)
 	return 0;
 
 err_irq:
+	arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona);
+	arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona);
+	arizona_free_irq(arizona, ARIZONA_IRQ_CLKGEN_ERR, arizona);
 	arizona_irq_exit(arizona);
 err_pm:
 	pm_runtime_disable(arizona->dev);
-- 
2.47.0

Re: [PATCH RESEND 3/5] mfd: arizona: Free info IRQs on probe failure

[Charles Keepax]

On Sat, Nov 07, 2026 at 04:21:22PM +0800, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> arizona_dev_init() registers three informational IRQs (CLKGEN error,
> Overclocked and Underclocked) with arizona_request_irq() before adding
> the sub-devices.  If mfd_add_devices() fails the error path only calls
> arizona_irq_exit(), which frees the CTRLIF_ERR/BOOT_DONE IRQs and the
> IRQ chip/domain but leaves these three requested IRQs behind; they are
> freed only in arizona_dev_exit() on the normal removal path.
> 
> As a result the three threaded IRQ handlers stay registered and
> irq_dispose_mapping()/irq_domain_remove() in arizona_irq_exit() act on
> virtual IRQs that are still in use.  Free them in the probe failure path
> too, in the same order as arizona_dev_exit().
> 
> Fixes: 3cc729869475 ("mfd: arizona: Core driver")
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> ---

Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>

Thanks,
Charles

[PATCH RESEND 4/5] mfd: da9052: Disable IRQ wake on device removal

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

da9052_irq_init() calls enable_irq_wake() on the chip IRQ but neither the
error path (when requesting the ADC_EOM IRQ fails) nor da9052_irq_exit()
(the removal path reached from da9052_i2c_remove()/da9052_spi_remove())
ever calls disable_irq_wake().  The wakeup configuration is therefore left
behind when the device is unbound; the IRQ line keeps being treated as a
wakeup source and, should the descriptor be reused by another device later,
the stale wake setting persists.

Track whether the wake source was successfully enabled and disable it
symmetrically on both the probe failure path and in da9052_irq_exit().

Fixes: ed05be56643e ("mfd: da9052: Register ability of device to cause a wake-up interrupt")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
diff --git a/drivers/mfd/da9052-irq.c b/drivers/mfd/da9052-irq.c
index abbdbf0337e2..da5bac424efc 100644
--- a/drivers/mfd/da9052-irq.c
+++ b/drivers/mfd/da9052-irq.c
@@ -259,7 +259,8 @@ int da9052_irq_init(struct da9052 *da9052)
 		goto regmap_err;
 	}
 
-	enable_irq_wake(da9052->chip_irq);
+	if (!enable_irq_wake(da9052->chip_irq))
+		da9052->irq_wake_enabled = true;
 
 	ret = da9052_request_irq(da9052, DA9052_IRQ_ADC_EOM, "adc-irq",
 			    da9052_auxadc_irq, da9052);
@@ -272,6 +273,10 @@ int da9052_irq_init(struct da9052 *da9052)
 	return 0;
 
 request_irq_err:
+	if (da9052->irq_wake_enabled) {
+		disable_irq_wake(da9052->chip_irq);
+		da9052->irq_wake_enabled = false;
+	}
 	regmap_del_irq_chip(da9052->chip_irq, da9052->irq_data);
 regmap_err:
 	return ret;
@@ -281,6 +286,10 @@ int da9052_irq_init(struct da9052 *da9052)
 int da9052_irq_exit(struct da9052 *da9052)
 {
 	da9052_free_irq(da9052, DA9052_IRQ_ADC_EOM, da9052);
+	if (da9052->irq_wake_enabled) {
+		disable_irq_wake(da9052->chip_irq);
+		da9052->irq_wake_enabled = false;
+	}
 	regmap_del_irq_chip(da9052->chip_irq, da9052->irq_data);
 
 	return 0;
diff --git a/include/linux/mfd/da9052/da9052.h b/include/linux/mfd/da9052/da9052.h
index 9cb2fc2938ce..d7dd36891539 100644
--- a/include/linux/mfd/da9052/da9052.h
+++ b/include/linux/mfd/da9052/da9052.h
@@ -93,6 +93,8 @@ struct da9052 {
 
 	int chip_irq;
 
+	bool irq_wake_enabled;
+
 	int fault_log;
 
 	/* SOC I/O transfer related fixes for DA9052/53 */
-- 
2.47.0

[PATCH RESEND 5/5] mfd: gateworks-gsc: Check firmware CRC reads for errors

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

gsc_probe() checks the return value of the GSC_FW_VER regmap_read() but
the two reads of GSC_FW_CRC just below it are not checked.  On an I2C
error regmap_read() leaves "reg" holding the value of the previous
successful read (the firmware version, or the CRC low byte), so
gsc->fwcrc ends up with a wrong value that is later printed as the
firmware revision, and the error is silently ignored.

Check both CRC reads and fail the probe with -EIO, matching the handling
of the version read above.

Fixes: d85234994b2f ("mfd: Add Gateworks System Controller core driver")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
diff --git a/drivers/mfd/gateworks-gsc.c b/drivers/mfd/gateworks-gsc.c
index a3301502ce6a..1d697e82ea29 100644
--- a/drivers/mfd/gateworks-gsc.c
+++ b/drivers/mfd/gateworks-gsc.c
@@ -219,9 +219,11 @@ static int gsc_probe(struct i2c_client *client)
 		return -EIO;
 	gsc->fwver = reg;
 
-	regmap_read(gsc->regmap, GSC_FW_CRC, &reg);
+	if (regmap_read(gsc->regmap, GSC_FW_CRC, &reg))
+		return -EIO;
 	gsc->fwcrc = reg;
-	regmap_read(gsc->regmap, GSC_FW_CRC + 1, &reg);
+	if (regmap_read(gsc->regmap, GSC_FW_CRC + 1, &reg))
+		return -EIO;
 	gsc->fwcrc |= reg << 8;
 
 	gsc->i2c_hwmon = devm_i2c_new_dummy_device(dev, client->adapter,
-- 
2.47.0