From: "Жамбакиев Радий Рикардинович" <r.zhambakiev@prosoftsystems.ru>
To: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: "Жамбакиев Радий Рикардинович" <r.zhambakiev@prosoftsystems.ru>,
"Andreas Kemnade" <andreas@kemnade.info>,
"Kevin Hilman" <khilman@baylibre.com>,
"Roger Quadros" <rogerq@kernel.org>,
"Tony Lindgren" <tony@atomide.com>, "Lee Jones" <lee@kernel.org>,
"Marcin Niestroj" <m.niestroj@grinn-global.com>,
"Grygorii Strashko" <grygorii.strashko@ti.com>,
"linux-omap@vger.kernel.org" <linux-omap@vger.kernel.org>,
"mfd@lists.linux.dev" <mfd@lists.linux.dev>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>
Subject: [PATCH v2 0/4] mfd: tps65217: Handle IRQ initialization errors
Date: Fri, 21 Aug 2026 12:37:20 +0000 [thread overview]
Message-ID: <20260821123712.260443-1-r.zhambakiev@prosoftsystems.ru> (raw)
This series fixes the error handling in the IRQ setup and teardown
paths of the TPS65217 MFD driver.
Patch 1 propagates the error from tps65217_irq_init() in probe, so a
failed irq_domain creation does not leave a NULL domain behind that
tps65217_remove() would later dereference.
Patch 2 propagates the error of the initial register write in
tps65217_irq_init(), so a failed mask write cannot leave the software
mask out of sync with the hardware.
Patch 3 fixes the irq_domain leak and the resulting
use-after-free when probe fails after the domain has been created.
Patch 4 fixes the NULL pointer dereference in the remove callback on
devices probed without an interrupt, quiesces the parent interrupt
before the domain is torn down, and balances enable_irq_wake().
Changes since v1:
- added "mfd: tps65217: Fix irq_domain leak and use-after-free on probe
failure"
- added "mfd: tps65217: Fix NULL pointer dereference in remove callback"
Patches 3 and 4 fix the in-scope findings of the Sashiko AI review.
The remaining findings, in my opinion, are out of scope for this series and may be
addressed in separate follow-up patches.
Radiy Zhambakiev (4):
mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
mfd: tps65217: Check return value when masking interrupt sources
mfd: tps65217: Fix irq_domain leak and use-after-free on probe failure
mfd: tps65217: Fix NULL pointer dereference in remove callback
drivers/mfd/tps65217.c | 68 ++++++++++++++++++++++++++++++------------
1 file changed, 49 insertions(+), 19 deletions(-)
--
2.53.0
next reply other threads:[~2026-08-21 12:37 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-21 12:37 Жамбакиев Радий Рикардинович [this message]
2026-08-21 12:37 ` [PATCH v2 1/4] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` [PATCH v2 2/4] mfd: tps65217: Check return value when masking interrupt sources Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` [PATCH v2 3/4] mfd: tps65217: Fix irq_domain leak and use-after-free on probe failure Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` [PATCH v2 4/4] mfd: tps65217: Fix NULL pointer dereference in remove callback Жамбакиев Радий Рикардинович
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260821123712.260443-1-r.zhambakiev@prosoftsystems.ru \
--to=r.zhambakiev@prosoftsystems.ru \
--cc=aaro.koskinen@iki.fi \
--cc=andreas@kemnade.info \
--cc=grygorii.strashko@ti.com \
--cc=khilman@baylibre.com \
--cc=lee@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-omap@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=m.niestroj@grinn-global.com \
--cc=mfd@lists.linux.dev \
--cc=rogerq@kernel.org \
--cc=tony@atomide.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox