[PATCH 07/28] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static

[PATCH 07/28] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static

[Lee Jones]

db8500_prcmu_register_ab8500() declares struct resource ab850x_resource
and the mfd_cell descriptors on the stack and assigns &ab850x_resource
to ab850x_cell->resources.  Although mfd_add_device() deep-copies the
resource table via platform_device_add_resources() before
db8500_prcmu_register_ab8500() returns, the shallow MFD cell copy
attached to the child platform device retains a stale pointer to the
expired stack frame.

Mark ab850x_resource as static and the ab8500_cell and ab8505_cell
descriptors as static const so the resource pointer remains valid for
the lifetime of the device.

Closes: https://sashiko.dev/#/bug/linux-554f3a1f-ca41-4078-ae9e-66d0d7fb4c9d
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/db8500-prcmu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index 6672c55f2ebc..cdfcbeb2a88c 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2953,16 +2953,15 @@ static const struct mfd_cell db8500_prcmu_devs[] = {
 
 static int db8500_prcmu_register_ab8500(struct device *parent)
 {
-	struct device_node *np;
-	struct resource ab850x_resource;
-	const struct mfd_cell ab8500_cell = {
+	static struct resource ab850x_resource;
+	static const struct mfd_cell ab8500_cell = {
 		.name = "ab8500-core",
 		.of_compatible = "stericsson,ab8500",
 		.id = AB8500_VERSION_AB8500,
 		.resources = &ab850x_resource,
 		.num_resources = 1,
 	};
-	const struct mfd_cell ab8505_cell = {
+	static const struct mfd_cell ab8505_cell = {
 		.name = "ab8505-core",
 		.of_compatible = "stericsson,ab8505",
 		.id = AB8500_VERSION_AB8505,
@@ -2970,6 +2969,7 @@ static int db8500_prcmu_register_ab8500(struct device *parent)
 		.num_resources = 1,
 	};
 	const struct mfd_cell *ab850x_cell;
+	struct device_node *np;
 
 	if (!parent->of_node)
 		return -ENODEV;
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 07/28] mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static

[Linus Walleij]

On Wed, Oct 21, 2026 at 2:14 PM Lee Jones <lee@kernel.org> wrote:

> db8500_prcmu_register_ab8500() declares struct resource ab850x_resource
> and the mfd_cell descriptors on the stack and assigns &ab850x_resource
> to ab850x_cell->resources.  Although mfd_add_device() deep-copies the
> resource table via platform_device_add_resources() before
> db8500_prcmu_register_ab8500() returns, the shallow MFD cell copy
> attached to the child platform device retains a stale pointer to the
> expired stack frame.
>
> Mark ab850x_resource as static and the ab8500_cell and ab8505_cell
> descriptors as static const so the resource pointer remains valid for
> the lifetime of the device.
>
> Closes: https://sashiko.dev/#/bug/linux-554f3a1f-ca41-4078-ae9e-66d0d7fb4c9d
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

[PATCH 22/28] mfd: abx500-core: Unregister device ops on devm release

[Lee Jones]

abx500_register_ops() allocates struct abx500_device_entry via
devm_kzalloc() and links it into the global abx500_list without
registering a devres cleanup action.  If a caller's probe function
subsequently fails, devres frees the entry while it remains linked in
abx500_list, causing use-after-free and list corruption on later
traversals.

Register a devm_add_action_or_reset() callback in abx500_register_ops()
to remove the entry from abx500_list before devres frees it.

Fixes: c211b6b9c014 ("mfd: abx500-core: Convert to managed resources for allocating memory")
Closes: https://sashiko.dev/#/bug/linux-6a9c6b8b-8f89-4af5-8cb1-102822e44e6e
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/abx500-core.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
index e896531d0354..5873e335c395 100644
--- a/drivers/mfd/abx500-core.c
+++ b/drivers/mfd/abx500-core.c
@@ -5,6 +5,7 @@
  * Author: Mattias Wallin <mattias.wallin@stericsson.com>
  */
 
+#include <linux/device.h>
 #include <linux/list.h>
 #include <linux/slab.h>
 #include <linux/err.h>
@@ -33,6 +34,21 @@ static void lookup_ops(struct device *dev, struct abx500_ops **ops)
 	}
 }
 
+void abx500_remove_ops(struct device *dev)
+{
+	struct abx500_device_entry *dev_entry, *tmp;
+
+	list_for_each_entry_safe(dev_entry, tmp, &abx500_list, list)
+		if (dev_entry->dev == dev)
+			list_del(&dev_entry->list);
+}
+EXPORT_SYMBOL(abx500_remove_ops);
+
+static void abx500_unregister_ops(void *data)
+{
+	abx500_remove_ops(data);
+}
+
 int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
 {
 	struct abx500_device_entry *dev_entry;
@@ -45,20 +61,11 @@ int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
 	memcpy(&dev_entry->ops, ops, sizeof(*ops));
 
 	list_add_tail(&dev_entry->list, &abx500_list);
-	return 0;
+
+	return devm_add_action_or_reset(dev, abx500_unregister_ops, dev);
 }
 EXPORT_SYMBOL(abx500_register_ops);
 
-void abx500_remove_ops(struct device *dev)
-{
-	struct abx500_device_entry *dev_entry, *tmp;
-
-	list_for_each_entry_safe(dev_entry, tmp, &abx500_list, list)
-		if (dev_entry->dev == dev)
-			list_del(&dev_entry->list);
-}
-EXPORT_SYMBOL(abx500_remove_ops);
-
 int abx500_set_register_interruptible(struct device *dev, u8 bank, u8 reg,
 	u8 value)
 {
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 22/28] mfd: abx500-core: Unregister device ops on devm release

[Linus Walleij]

On Wed, Oct 21, 2026 at 2:16 PM Lee Jones <lee@kernel.org> wrote:

> abx500_register_ops() allocates struct abx500_device_entry via
> devm_kzalloc() and links it into the global abx500_list without
> registering a devres cleanup action.  If a caller's probe function
> subsequently fails, devres frees the entry while it remains linked in
> abx500_list, causing use-after-free and list corruption on later
> traversals.
>
> Register a devm_add_action_or_reset() callback in abx500_register_ops()
> to remove the entry from abx500_list before devres frees it.
>
> Fixes: c211b6b9c014 ("mfd: abx500-core: Convert to managed resources for allocating memory")
> Closes: https://sashiko.dev/#/bug/linux-6a9c6b8b-8f89-4af5-8cb1-102822e44e6e
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

[PATCH 23/28] mfd: ab8500-core: Register sysfs attribute groups via devm_device_add_group()

[Lee Jones]

ab8500_probe() registers up to two sysfs attribute groups with
sysfs_create_group().  On AB8505 and AB9540 (cut 2.0 and later), the
second sysfs_create_group() call unconditionally overwrites the return
value of the first, and if the second call fails, ab8500_probe() returns
an error without removing the first group.  Because the driver context
is freed and driver data is cleared on probe failure, reading any leaked
sysfs attribute dereferences a NULL ab8500 pointer in
get_register_interruptible().

Register the attribute groups via devm_device_add_group() and only
register the second group when the first succeeds so that devres
automatically cleans up registered sysfs attributes on probe failure.

Fixes: 93ff722e8853 ("ab8500-fg: Add power cut feature for ab8505 and ab8540")
Closes: https://sashiko.dev/#/bug/linux-a9ac1a9d-5a97-4ad3-b4c5-c7775c24a333
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/ab8500-core.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 86fa99022cb3..408bad2f577a 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -1232,16 +1232,13 @@ static int ab8500_probe(struct platform_device *pdev)
 
 	if (((is_ab8505(ab8500) || is_ab9540(ab8500)) &&
 			ab8500->chip_id >= AB8500_CUT2P0) || is_ab8540(ab8500))
-		ret = sysfs_create_group(&ab8500->dev->kobj,
-					&ab9540_attr_group);
+		ret = devm_device_add_group(ab8500->dev, &ab9540_attr_group);
 	else
-		ret = sysfs_create_group(&ab8500->dev->kobj,
-					&ab8500_attr_group);
+		ret = devm_device_add_group(ab8500->dev, &ab8500_attr_group);
 
 	if ((is_ab8505(ab8500) || is_ab9540(ab8500)) &&
-			ab8500->chip_id >= AB8500_CUT2P0)
-		ret = sysfs_create_group(&ab8500->dev->kobj,
-					 &ab8505_attr_group);
+			ab8500->chip_id >= AB8500_CUT2P0 && !ret)
+		ret = devm_device_add_group(ab8500->dev, &ab8505_attr_group);
 
 	if (ret)
 		dev_err(ab8500->dev, "error creating sysfs entries\n");
-- 
2.56.0.218.g1ec904b173-goog

Re: [PATCH 23/28] mfd: ab8500-core: Register sysfs attribute groups via devm_device_add_group()

[Linus Walleij]

Hi Lee,

On Wed, Oct 21, 2026 at 2:16 PM Lee Jones <lee@kernel.org> wrote:

> ab8500_probe() registers up to two sysfs attribute groups with
> sysfs_create_group().  On AB8505 and AB9540 (cut 2.0 and later), the
> second sysfs_create_group() call unconditionally overwrites the return
> value of the first, and if the second call fails, ab8500_probe() returns
> an error without removing the first group.  Because the driver context
> is freed and driver data is cleared on probe failure, reading any leaked
> sysfs attribute dereferences a NULL ab8500 pointer in
> get_register_interruptible().
>
> Register the attribute groups via devm_device_add_group() and only
> register the second group when the first succeeds so that devres
> automatically cleans up registered sysfs attributes on probe failure.
>
> Fixes: 93ff722e8853 ("ab8500-fg: Add power cut feature for ab8505 and ab8540")
> Closes: https://sashiko.dev/#/bug/linux-a9ac1a9d-5a97-4ad3-b4c5-c7775c24a333
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Neat, thanks for fixing!
Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

[PATCH 25/28] mfd: mt6397: Manage IRQ domain lifecycle with devres

[Lee Jones]

mt6397_irq_init() and mt6358_irq_init() create chip->irq_domain with
irq_domain_create_linear() before registering the parent interrupt via
devm_request_threaded_irq().  If devm_mfd_add_devices() fails in
mt6397_probe(), irq_domain_remove() is called before devres frees the
threaded IRQ and without disposing child IRQ mappings, allowing an
in-flight interrupt handler or late IRQ lookup to dereference the
removed domain.  Conversely, when the driver is unbound, the IRQ
mappings and domain are never removed at all.

Register a devres action immediately after irq_domain_create_linear() to
dispose all mapped hardware interrupts and remove chip->irq_domain so
that the domain is torn down after child MFD devices and the managed IRQ
handler have been released on both probe failure and unbind.

Fixes: 6df8dd5c185b ("mfd: Add support for the MediaTek MT6397 PMIC")
Closes: https://sashiko.dev/#/bug/linux-b296fbe4-6e83-40c0-91c7-2c31e8d226d0
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/mt6358-irq.c  | 17 ++++++++++++++++-
 drivers/mfd/mt6397-core.c |  4 +---
 drivers/mfd/mt6397-irq.c  | 16 +++++++++++++++-
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/mt6358-irq.c b/drivers/mfd/mt6358-irq.c
index 74cf20843044..c747cae909ea 100644
--- a/drivers/mfd/mt6358-irq.c
+++ b/drivers/mfd/mt6358-irq.c
@@ -224,6 +224,17 @@ static const struct irq_domain_ops mt6358_irq_domain_ops = {
 	.xlate = irq_domain_xlate_twocell,
 };
 
+static void mt6358_irq_domain_remove(void *data)
+{
+	struct mt6397_chip *chip = data;
+	struct pmic_irq_data *irqd = chip->irq_data;
+
+	for (unsigned int hwirq = 0; hwirq < irqd->num_pmic_irqs; hwirq++)
+		irq_dispose_mapping(irq_find_mapping(chip->irq_domain, hwirq));
+
+	irq_domain_remove(chip->irq_domain);
+}
+
 int mt6358_irq_init(struct mt6397_chip *chip)
 {
 	int i, j, ret;
@@ -279,13 +290,17 @@ int mt6358_irq_init(struct mt6397_chip *chip)
 		return -ENODEV;
 	}
 
+	ret = devm_add_action_or_reset(chip->dev, mt6358_irq_domain_remove,
+				       chip);
+	if (ret)
+		return ret;
+
 	ret = devm_request_threaded_irq(chip->dev, chip->irq, NULL,
 					mt6358_irq_handler, IRQF_ONESHOT,
 					mt6358_irq_chip.name, chip);
 	if (ret) {
 		dev_err(chip->dev, "Failed to register IRQ=%d, ret=%d\n",
 			chip->irq, ret);
-		irq_domain_remove(chip->irq_domain);
 		return ret;
 	}
 
diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
index 9ec951996588..e94e37cba249 100644
--- a/drivers/mfd/mt6397-core.c
+++ b/drivers/mfd/mt6397-core.c
@@ -395,10 +395,8 @@ static int mt6397_probe(struct platform_device *pdev)
 	ret = devm_mfd_add_devices(&pdev->dev, PLATFORM_DEVID_NONE,
 				   pmic_core->cells, pmic_core->cell_size,
 				   NULL, 0, pmic->irq_domain);
-	if (ret) {
-		irq_domain_remove(pmic->irq_domain);
+	if (ret)
 		dev_err(&pdev->dev, "failed to add child devices: %d\n", ret);
-	}
 
 	return ret;
 }
diff --git a/drivers/mfd/mt6397-irq.c b/drivers/mfd/mt6397-irq.c
index 5d2e5459f744..58645dbd8095 100644
--- a/drivers/mfd/mt6397-irq.c
+++ b/drivers/mfd/mt6397-irq.c
@@ -169,6 +169,16 @@ static int mt6397_irq_pm_notifier(struct notifier_block *notifier,
 	return NOTIFY_DONE;
 }
 
+static void mt6397_irq_domain_remove(void *data)
+{
+	struct mt6397_chip *chip = data;
+
+	for (int hwirq = 0; hwirq < MT6397_IRQ_NR; hwirq++)
+		irq_dispose_mapping(irq_find_mapping(chip->irq_domain, hwirq));
+
+	irq_domain_remove(chip->irq_domain);
+}
+
 int mt6397_irq_init(struct mt6397_chip *chip)
 {
 	int ret;
@@ -223,13 +233,17 @@ int mt6397_irq_init(struct mt6397_chip *chip)
 		return -ENOMEM;
 	}
 
+	ret = devm_add_action_or_reset(chip->dev, mt6397_irq_domain_remove,
+				       chip);
+	if (ret)
+		return ret;
+
 	ret = devm_request_threaded_irq(chip->dev, chip->irq, NULL,
 					mt6397_irq_thread, IRQF_ONESHOT,
 					"mt6397-pmic", chip);
 	if (ret) {
 		dev_err(chip->dev, "failed to register irq=%d; err: %d\n",
 			chip->irq, ret);
-		irq_domain_remove(chip->irq_domain);
 		return ret;
 	}
 
-- 
2.56.0.218.g1ec904b173-goog

[PATCH 26/28] mfd: mt6397: Unregister PM notifier on probe failure and unbind

[Lee Jones]

mt6397_irq_init() registers a power management notifier block embedded
in the devres-managed struct mt6397_chip via register_pm_notifier(),
but never unregisters it if mt6397_probe() later fails or when the
driver is unbound.  Once devres frees struct mt6397_chip, the dangling
notifier block corrupts the global PM notifier chain and causes a
use-after-free on subsequent suspend or resume transitions.

Check the return value of register_pm_notifier() and register a devres
action to unregister the PM notifier on probe failure or device unbind.

Fixes: 4e2e7cfec13a ("mfd: mt6397: Modify suspend/resume behavior")
Closes: https://sashiko.dev/#/bug/linux-edb62fbc-213a-49a2-be55-c002e234e554
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/mt6397-irq.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/mt6397-irq.c b/drivers/mfd/mt6397-irq.c
index 58645dbd8095..bc7ca22d6f17 100644
--- a/drivers/mfd/mt6397-irq.c
+++ b/drivers/mfd/mt6397-irq.c
@@ -179,6 +179,13 @@ static void mt6397_irq_domain_remove(void *data)
 	irq_domain_remove(chip->irq_domain);
 }
 
+static void mt6397_unregister_pm_notifier(void *data)
+{
+	struct mt6397_chip *chip = data;
+
+	unregister_pm_notifier(&chip->pm_nb);
+}
+
 int mt6397_irq_init(struct mt6397_chip *chip)
 {
 	int ret;
@@ -247,6 +254,10 @@ int mt6397_irq_init(struct mt6397_chip *chip)
 		return ret;
 	}
 
-	register_pm_notifier(&chip->pm_nb);
-	return 0;
+	ret = register_pm_notifier(&chip->pm_nb);
+	if (ret)
+		return ret;
+
+	return devm_add_action_or_reset(chip->dev,
+					mt6397_unregister_pm_notifier, chip);
 }
-- 
2.56.0.218.g1ec904b173-goog