Linux on ARM based TI OMAP SoCs
 help / color / mirror / Atom feed
From: "Жамбакиев Радий Рикардинович" <r.zhambakiev@prosoftsystems.ru>
To: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: "Жамбакиев Радий Рикардинович" <r.zhambakiev@prosoftsystems.ru>,
	"Andreas Kemnade" <andreas@kemnade.info>,
	"Kevin Hilman" <khilman@baylibre.com>,
	"Roger Quadros" <rogerq@kernel.org>,
	"Tony Lindgren" <tony@atomide.com>, "Lee Jones" <lee@kernel.org>,
	"Marcin Niestroj" <m.niestroj@grinn-global.com>,
	"Grygorii Strashko" <grygorii.strashko@ti.com>,
	"linux-omap@vger.kernel.org" <linux-omap@vger.kernel.org>,
	"mfd@lists.linux.dev" <mfd@lists.linux.dev>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: [PATCH v2 1/4] mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
Date: Fri, 21 Aug 2026 12:37:21 +0000	[thread overview]
Message-ID: <20260821123712.260443-2-r.zhambakiev@prosoftsystems.ru> (raw)
In-Reply-To: <20260821123712.260443-1-r.zhambakiev@prosoftsystems.ru>

tps65217_probe() ignores the return value of tps65217_irq_init(), so
when the irq domain creation fails the probe still completes and the
driver ends up bound with a NULL tps->irq_domain. Unloading the
module then makes tps65217_remove() call irq_domain_remove() on the
NULL pointer and oops the kernel. On top of that, irq_find_mapping()
may fall back to the default irq domain and dispose of mappings that
belong to other interrupt controllers.

Check the return value and abort the probe on failure so the error
is reported and no inconsistent state is left for removal.

Fixes: 6556bdacf646fcaa ("mfd: tps65217: Add support for IRQs")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
---
 drivers/mfd/tps65217.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index c240fac0ede7..2d04d9e0ae29 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -333,7 +333,9 @@ static int tps65217_probe(struct i2c_client *client)
 	}
 
 	if (client->irq) {
-		tps65217_irq_init(tps, client->irq);
+		ret = tps65217_irq_init(tps, client->irq);
+		if (ret)
+			return ret;
 	} else {
 		int i;
 
-- 
2.53.0

  reply	other threads:[~2026-08-21 12:37 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-21 12:37 [PATCH v2 0/4] mfd: tps65217: Handle IRQ initialization errors Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` Жамбакиев Радий Рикардинович [this message]
2026-08-21 12:37 ` [PATCH v2 2/4] mfd: tps65217: Check return value when masking interrupt sources Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` [PATCH v2 3/4] mfd: tps65217: Fix irq_domain leak and use-after-free on probe failure Жамбакиев Радий Рикардинович
2026-08-21 12:37 ` [PATCH v2 4/4] mfd: tps65217: Fix NULL pointer dereference in remove callback Жамбакиев Радий Рикардинович

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260821123712.260443-2-r.zhambakiev@prosoftsystems.ru \
    --to=r.zhambakiev@prosoftsystems.ru \
    --cc=aaro.koskinen@iki.fi \
    --cc=andreas@kemnade.info \
    --cc=grygorii.strashko@ti.com \
    --cc=khilman@baylibre.com \
    --cc=lee@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-omap@vger.kernel.org \
    --cc=lvc-project@linuxtesting.org \
    --cc=m.niestroj@grinn-global.com \
    --cc=mfd@lists.linux.dev \
    --cc=rogerq@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tony@atomide.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox