Linux on ARM based TI OMAP SoCs
 help / color / mirror / Atom feed
From: "Жамбакиев Радий Рикардинович" <r.zhambakiev@prosoftsystems.ru>
To: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: "Жамбакиев Радий Рикардинович" <r.zhambakiev@prosoftsystems.ru>,
	"Andreas Kemnade" <andreas@kemnade.info>,
	"Kevin Hilman" <khilman@baylibre.com>,
	"Roger Quadros" <rogerq@kernel.org>,
	"Tony Lindgren" <tony@atomide.com>, "Lee Jones" <lee@kernel.org>,
	"Marcin Niestroj" <m.niestroj@grinn-global.com>,
	"Grygorii Strashko" <grygorii.strashko@ti.com>,
	"linux-omap@vger.kernel.org" <linux-omap@vger.kernel.org>,
	"mfd@lists.linux.dev" <mfd@lists.linux.dev>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>
Subject: [PATCH v2 0/4] mfd: tps65217: Handle IRQ initialization errors
Date: Fri, 21 Aug 2026 12:37:20 +0000	[thread overview]
Message-ID: <20260821123712.260443-1-r.zhambakiev@prosoftsystems.ru> (raw)

This series fixes the error handling in the IRQ setup and teardown
paths of the TPS65217 MFD driver.

Patch 1 propagates the error from tps65217_irq_init() in probe, so a
failed irq_domain creation does not leave a NULL domain behind that
tps65217_remove() would later dereference.
Patch 2 propagates the error of the initial register write in
tps65217_irq_init(), so a failed mask write cannot leave the software
mask out of sync with the hardware.
Patch 3 fixes the irq_domain leak and the resulting 
use-after-free when probe fails after the domain has been created.
Patch 4 fixes the NULL pointer dereference in the remove callback on
devices probed without an interrupt, quiesces the parent interrupt
before the domain is torn down, and balances enable_irq_wake().

Changes since v1:
- added "mfd: tps65217: Fix irq_domain leak and use-after-free on probe
  failure"
- added "mfd: tps65217: Fix NULL pointer dereference in remove callback"

Patches 3 and 4 fix the in-scope findings of the Sashiko AI review.
The remaining findings, in my opinion, are out of scope for this series and may be
addressed in separate follow-up patches.

Radiy Zhambakiev (4):
  mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
  mfd: tps65217: Check return value when masking interrupt sources
  mfd: tps65217: Fix irq_domain leak and use-after-free on probe failure
  mfd: tps65217: Fix NULL pointer dereference in remove callback

 drivers/mfd/tps65217.c | 68 ++++++++++++++++++++++++++++++------------
 1 file changed, 49 insertions(+), 19 deletions(-)

-- 
2.53.0

             reply	other threads:[~2026-08-21 12:37 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-21 12:37 Жамбакиев Радий Рикардинович [this message]
2026-08-21 12:37 ` [PATCH v2 1/4] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` [PATCH v2 2/4] mfd: tps65217: Check return value when masking interrupt sources Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` [PATCH v2 3/4] mfd: tps65217: Fix irq_domain leak and use-after-free on probe failure Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` [PATCH v2 4/4] mfd: tps65217: Fix NULL pointer dereference in remove callback Жамбакиев Радий Рикардинович

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260821123712.260443-1-r.zhambakiev@prosoftsystems.ru \
    --to=r.zhambakiev@prosoftsystems.ru \
    --cc=aaro.koskinen@iki.fi \
    --cc=andreas@kemnade.info \
    --cc=grygorii.strashko@ti.com \
    --cc=khilman@baylibre.com \
    --cc=lee@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-omap@vger.kernel.org \
    --cc=lvc-project@linuxtesting.org \
    --cc=m.niestroj@grinn-global.com \
    --cc=mfd@lists.linux.dev \
    --cc=rogerq@kernel.org \
    --cc=tony@atomide.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox