[PATCH v2 00/27] mfd: Assorted resource lifetime, teardown, and error-handling fixes

[PATCH v2 00/27] mfd: Assorted resource lifetime, teardown, and error-handling fixes

[Lee Jones]

These issues were reported by Sashiko.

This series addresses a collection of resource lifetime, teardown
ordering, error-handling, and bounds-checking bugs across several MFD
drivers.

v1 => v2:
 - Collected Acked-by, Reviewed-by, and Tested-by tags from the list
 - Dropped "mfd: cgbc: Zero-initialise version buffer in
   cgbc_get_version()" in favour of Thomas Richard's upcoming central
   cgbc_command() validation series
 - Restored Fixes: tags (without Cc: stable@vger.kernel.org) on the four
   non-Stable MFD cell stack-pointer clean-ups (ls2kbmc, bd96801,
   ti_am335x_tscadc, and db8500-prcmu)

Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: Andi Shyti <andi.shyti@kernel.org>
Cc: Andreas Kemnade <andreas@kemnade.info>
Cc: Andy Shevchenko <andy@kernel.org>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: AnilKumar Ch <anilkumar@ti.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Binbin Zhou <zhoubinbin@loongson.cn>
Cc: Brent Casavant <bcasavan@sgi.com>
Cc: Chong Qiao <qiaochong@loongson.cn>
Cc: Corey Minyard <corey@minyard.net>
Cc: David Lechner <dlechner@baylibre.com>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Gyungoh Yoo <jack.yoo@maxim-ic.com>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Hsin-Hsiung Wang <hsin-hsiung.wang@mediatek.com>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: Joshua Kinard <linux@kumba.dev>
Cc: Kai Svahn <kai.svahn@nokia.com>
Cc: Kevin Hilman <khilman@baylibre.com>
Cc: Kumar Sanghvi <kumar.sanghvi@stericsson.com>
Cc: Linus Walleij <linusw@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-crypto@vger.kernel.org
Cc: linux-i2c@vger.kernel.org
Cc: linux-iio@vger.kernel.org
Cc: linux-input@vger.kernel.org
Cc: linux-mediatek@lists.infradead.org
Cc: linux-omap@vger.kernel.org
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Mattias Nilsson <mattias.i.nilsson@stericsson.com>
Cc: Mattias Wallin <mattias.wallin@stericsson.com>
Cc: Matti Vaittinen <mazziesaccount@gmail.com>
Cc: mfd@lists.linux.dev
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Milo Kim <woogyom.kim@gmail.com>
Cc: Ming Yu <tmyu0@nuvoton.com>
Cc: "Nuno Sá" <nuno.sa@analog.com>
Cc: Pantelis Antoniou <panto@antoniou-consulting.com>
Cc: Pat Gefre <pfg@sgi.com>
Cc: Paul Burton <paulburton@kernel.org>
Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
Cc: Qunqin Zhao <zhaoqunqin@loongson.cn>
Cc: Rabin Vincent <rabin.vincent@stericsson.com>
Cc: Rachna Patil <rachna@ti.com>
Cc: Roger Quadros <rogerq@kernel.org>
Cc: Samuel Ortiz <sameo@linux.intel.com>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Shi Hao <i.shihao.999@gmail.com>
Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Cc: Stanislaw Skowronek <skylark@unaligned.org>
Cc: Stephen Warren <swarren@nvidia.com>
Cc: Sundar Iyer <sundar.iyer@stericsson.com>
Cc: syed khasim <x0khasim@ti.com>
Cc: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Cc: Thomas Richard <thomas.richard@bootlin.com>
Cc: Tony Lindgren <tony@atomide.com>
Cc: Yinggang Gu <guyinggang@loongson.cn>

Lee Jones (27):
  mfd: nct6694: Allocate USB DMA buffers with kzalloc_obj()
  mfd: ls2kbmc: Unregister GPIO GSI via devm_add_action_or_reset()
  mfd: ls2kbmc: Cancel reset work on teardown via devm_work_autocancel()
  mfd: ls2kbmc: Allocate simplefb platform_data on the heap
  mfd: bd96801: Allocate watchdog IRQ resource on the heap
  mfd: ti_am335x_tscadc: Retrieve parent driver data via
    dev_get_drvdata()
  mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static
  mfd: nct6694: Do not resubmit interrupt URB on endpoint stall (-EPIPE)
  mfd: ioc3: Request parent IRQ via request_irq() and free before domain
    removal
  mfd: intel-lpss: Remove registered MFD child devices on probe failure
  mfd: max8907: Manage power-off handler via
    devm_register_sys_off_handler()
  mfd: twl-core: Clear pm_power_off callback in twl_remove()
  mfd: twl-core: Clear twl_priv pointer on teardown and probe failure
  mfd: loongson-se: Check return value of dma_set_mask_and_coherent()
  mfd: loongson-se: Zero-initialise controller command structures
  mfd: loongson-se: Reinitialise completions and wait uninterruptibly
    for commands
  mfd: loongson-se: Zero-allocate driver data and initialise engine
    completions in probe
  mfd: loongson-se: Prevent out-of-bounds engine access in
    se_irq_handler()
  mfd: loongson-se: Stop controller and mask interrupts on teardown and
    shutdown
  mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ
    registration
  mfd: abx500-core: Unregister device ops on devm release
  mfd: ab8500-core: Register sysfs attribute groups via
    devm_device_add_group()
  mfd: tps65217: Manage IRQ domain teardown via devres
  mfd: mt6397: Manage IRQ domain lifecycle with devres
  mfd: mt6397: Unregister PM notifier on probe failure and unbind
  i2c: cgbc: Propagate hardware errors when polling read status
  mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper

 drivers/i2c/busses/i2c-cgbc.c             |  27 ++++--
 drivers/iio/adc/ti_am335x_adc.c           |   2 +-
 drivers/input/touchscreen/ti_am335x_tsc.c |   2 +-
 drivers/mfd/ab8500-core.c                 |  11 +--
 drivers/mfd/abx500-core.c                 |  29 +++---
 drivers/mfd/db8500-prcmu.c                |   8 +-
 drivers/mfd/intel-lpss.c                  |   1 +
 drivers/mfd/ioc3.c                        |  32 ++++---
 drivers/mfd/loongson-se.c                 | 110 +++++++++++++++++-----
 drivers/mfd/ls2k-bmc-core.c               |  27 ++++--
 drivers/mfd/max8907.c                     |  28 ++++--
 drivers/mfd/mt6358-irq.c                  |  17 +++-
 drivers/mfd/mt6397-core.c                 |   4 +-
 drivers/mfd/mt6397-irq.c                  |  31 +++++-
 drivers/mfd/nct6694.c                     |  23 +++--
 drivers/mfd/rohm-bd96801.c                |  11 ++-
 drivers/mfd/ti_am335x_tscadc.c            |   7 +-
 drivers/mfd/tps65217.c                    |  40 ++++----
 drivers/mfd/twl-core.c                    |  45 +++++----
 include/linux/mfd/loongson-se.h           |   8 +-
 include/linux/mfd/ti_am335x_tscadc.h      |   7 --
 21 files changed, 326 insertions(+), 144 deletions(-)

-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 12/27] mfd: twl-core: Clear pm_power_off callback in twl_remove()

[Lee Jones]

When a TWL6030-class device is configured as the system power
controller, twl_probe() registers twl6030_power_off() as the global
pm_power_off callback.  However, twl_remove() does not clear
pm_power_off when tearing down the device on late probe failure or
driver unbind, leaving a dangling callback that dereferences the freed
twl_priv context during system shutdown.

Reset pm_power_off to NULL in twl_remove() when it points to
twl6030_power_off().

Fixes: ca9414a1d087 ("mfd: twl-core: Add power off implementation for twl603x")
Closes: https://sashiko.dev/#/bug/linux-f5847f26-c868-416a-b926-3fc3da57802d
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/twl-core.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index c024a28b057e..64b45fe79159 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -672,10 +672,26 @@ static void clocks_init(struct device *dev)
 /*----------------------------------------------------------------------*/
 
 
+static void twl6030_power_off(void)
+{
+	int err;
+	u8 val;
+
+	err = twl_i2c_read_u8(TWL_MODULE_PM_MASTER, &val, TWL6030_PHOENIX_DEV_ON);
+	if (err)
+		return;
+
+	val |= TWL6030_APP_DEVOFF | TWL6030_CON_DEVOFF | TWL6030_MOD_DEVOFF;
+	twl_i2c_write_u8(TWL_MODULE_PM_MASTER, val, TWL6030_PHOENIX_DEV_ON);
+}
+
 static void twl_remove(struct i2c_client *client)
 {
 	unsigned i, num_slaves;
 
+	if (pm_power_off == twl6030_power_off)
+		pm_power_off = NULL;
+
 	if (twl_class_is_4030())
 		twl4030_exit_irq();
 	else
@@ -692,19 +708,6 @@ static void twl_remove(struct i2c_client *client)
 	twl_priv->ready = false;
 }
 
-static void twl6030_power_off(void)
-{
-	int err;
-	u8 val;
-
-	err = twl_i2c_read_u8(TWL_MODULE_PM_MASTER, &val, TWL6030_PHOENIX_DEV_ON);
-	if (err)
-		return;
-
-	val |= TWL6030_APP_DEVOFF | TWL6030_CON_DEVOFF | TWL6030_MOD_DEVOFF;
-	twl_i2c_write_u8(TWL_MODULE_PM_MASTER, val, TWL6030_PHOENIX_DEV_ON);
-}
-
 
 static struct of_dev_auxdata twl_auxdata_lookup[] = {
 	OF_DEV_AUXDATA("ti,twl4030-gpio", 0, "twl4030-gpio", NULL),
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 13/27] mfd: twl-core: Clear twl_priv pointer on teardown and probe failure

[Lee Jones]

twl_probe() allocates the file-scope twl_priv state with devm_kzalloc()
and checks for a non-NULL twl_priv at entry to reject multiple device
instances.  However, twl_remove() and the early error paths in
twl_probe() never reset twl_priv to NULL, a failure when adding MFD
child devices bypasses twl_remove() by jumping to free instead of fail,
and twl_remove() tears down the IRQ domain and dummy I2C clients before
child devices are unregistered.  After devres frees the underlying
memory on probe failure or unbind, twl_priv remains a dangling pointer,
causing subsequent exported API calls to dereference freed memory and
blocking future probe attempts with -EBUSY.

Unregister DT-populated and MFD child devices at the start of
twl_remove(), ensure mfd_add_devices() failures unwind via fail, and
reset twl_priv to NULL in twl_remove() and on probe error exit.

Fixes: 80a97ccd33be ("mfd: twl-core: Collect global variables behind one private structure (global)")
Closes: https://sashiko.dev/#/bug/linux-73e82f84-94de-4d08-82a4-f22d42a1dedf
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/twl-core.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
index 64b45fe79159..21fc0acb827b 100644
--- a/drivers/mfd/twl-core.c
+++ b/drivers/mfd/twl-core.c
@@ -689,6 +689,11 @@ static void twl_remove(struct i2c_client *client)
 {
 	unsigned i, num_slaves;
 
+	of_platform_depopulate(&client->dev);
+
+	if (twl_class_is_6030())
+		mfd_remove_devices(&client->dev);
+
 	if (pm_power_off == twl6030_power_off)
 		pm_power_off = NULL;
 
@@ -706,6 +711,7 @@ static void twl_remove(struct i2c_client *client)
 		twl->client = NULL;
 	}
 	twl_priv->ready = false;
+	twl_priv = NULL;
 }
 
 
@@ -880,10 +886,10 @@ twl_probe(struct i2c_client *client)
 			num_cells = ARRAY_SIZE(twl6030_cells);
 		}
 
-		status = devm_mfd_add_devices(&client->dev, PLATFORM_DEVID_NONE,
-					      cells, num_cells, NULL, 0, NULL);
+		status = mfd_add_devices(&client->dev, PLATFORM_DEVID_NONE,
+					 cells, num_cells, NULL, 0, NULL);
 		if (status < 0)
-			goto free;
+			goto fail;
 
 		if (of_device_is_system_power_controller(node)) {
 			if (!pm_power_off)
@@ -900,8 +906,10 @@ twl_probe(struct i2c_client *client)
 	if (status < 0)
 		twl_remove(client);
 free:
-	if (status < 0)
+	if (status < 0) {
 		platform_device_unregister(pdev);
+		twl_priv = NULL;
+	}
 
 	return status;
 }
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v2 23/27] mfd: tps65217: Manage IRQ domain teardown via devres

[Lee Jones]

tps65217_irq_init() creates tps->irq_domain with an unmanaged call and
requests the parent interrupt via devm_request_threaded_irq(), while
tps65217_remove() manually disposes mappings and removes
tps->irq_domain.  Because tps65217_remove() executes before devres
teardown, the IRQ domain is destroyed while tps65217_irq_thread() and
child MFD devices are still active, allowing a concurrent interrupt to
dereference a freed or NULL domain.  Furthermore, if probe fails after
irq_domain_create_linear() or if tps65217_irq_init() fails, the IRQ
domain is leaked, and if the device is probed without an interrupt
(client->irq == 0), tps65217_remove() unconditionally passes a NULL
tps->irq_domain to irq_domain_remove().

Register a devres action to tear down the IRQ domain in
tps65217_irq_init() prior to devm_request_threaded_irq(), propagate
errors from tps65217_irq_init() in tps65217_probe(), and drop
tps65217_remove().

Fixes: 40a50f8b307d ("mfd: tps65217: Fix page fault on unloading modules")
Closes: https://sashiko.dev/#/bug/linux-7e358c08-6d75-48be-87d2-35dc037ea953
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/mfd/tps65217.c | 40 ++++++++++++++++++++++------------------
 1 file changed, 22 insertions(+), 18 deletions(-)

diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
index c240fac0ede7..a1e9b9e22d82 100644
--- a/drivers/mfd/tps65217.c
+++ b/drivers/mfd/tps65217.c
@@ -146,6 +146,21 @@ static const struct irq_domain_ops tps65217_irq_domain_ops = {
 	.map = tps65217_irq_map,
 };
 
+static void tps65217_irq_exit(void *data)
+{
+	struct tps65217 *tps = data;
+	unsigned int virq;
+
+	for (int i = 0; i < TPS65217_NUM_IRQ; i++) {
+		virq = irq_find_mapping(tps->irq_domain, i);
+		if (virq)
+			irq_dispose_mapping(virq);
+	}
+
+	irq_domain_remove(tps->irq_domain);
+	tps->irq_domain = NULL;
+}
+
 static int tps65217_irq_init(struct tps65217 *tps, int irq)
 {
 	int ret;
@@ -165,6 +180,10 @@ static int tps65217_irq_init(struct tps65217 *tps, int irq)
 		return -ENOMEM;
 	}
 
+	ret = devm_add_action_or_reset(tps->dev, tps65217_irq_exit, tps);
+	if (ret)
+		return ret;
+
 	ret = devm_request_threaded_irq(tps->dev, irq, NULL,
 					tps65217_irq_thread, IRQF_ONESHOT,
 					"tps65217-irq", tps);
@@ -333,7 +352,9 @@ static int tps65217_probe(struct i2c_client *client)
 	}
 
 	if (client->irq) {
-		tps65217_irq_init(tps, client->irq);
+		ret = tps65217_irq_init(tps, client->irq);
+		if (ret)
+			return ret;
 	} else {
 		int i;
 
@@ -373,22 +394,6 @@ static int tps65217_probe(struct i2c_client *client)
 	return 0;
 }
 
-static void tps65217_remove(struct i2c_client *client)
-{
-	struct tps65217 *tps = i2c_get_clientdata(client);
-	unsigned int virq;
-	int i;
-
-	for (i = 0; i < TPS65217_NUM_IRQ; i++) {
-		virq = irq_find_mapping(tps->irq_domain, i);
-		if (virq)
-			irq_dispose_mapping(virq);
-	}
-
-	irq_domain_remove(tps->irq_domain);
-	tps->irq_domain = NULL;
-}
-
 static const struct i2c_device_id tps65217_id_table[] = {
 	{"tps65217", TPS65217},
 	{ /* sentinel */ }
@@ -402,7 +407,6 @@ static struct i2c_driver tps65217_driver = {
 	},
 	.id_table	= tps65217_id_table,
 	.probe		= tps65217_probe,
-	.remove		= tps65217_remove,
 };
 
 static int __init tps65217_init(void)
-- 
2.56.0.307.g5fe7bd680c-goog

Re: [PATCH v2 13/27] mfd: twl-core: Clear twl_priv pointer on teardown and probe failure

[Andreas Kemnade]

On Tue, 27 Oct 2026 09:30:42 +0000
Lee Jones <lee@kernel.org> wrote:

> twl_probe() allocates the file-scope twl_priv state with devm_kzalloc()
> and checks for a non-NULL twl_priv at entry to reject multiple device
> instances.  However, twl_remove() and the early error paths in
> twl_probe() never reset twl_priv to NULL, a failure when adding MFD
> child devices bypasses twl_remove() by jumping to free instead of fail,
> and twl_remove() tears down the IRQ domain and dummy I2C clients before
> child devices are unregistered.  After devres frees the underlying
> memory on probe failure or unbind, twl_priv remains a dangling pointer,
> causing subsequent exported API calls to dereference freed memory and
> blocking future probe attempts with -EBUSY.
> 
> Unregister DT-populated and MFD child devices at the start of
> twl_remove(), ensure mfd_add_devices() failures unwind via fail, and
> reset twl_priv to NULL in twl_remove() and on probe error exit.
> 
> Fixes: 80a97ccd33be ("mfd: twl-core: Collect global variables behind one private structure (global)")
> Closes: https://sashiko.dev/#/bug/linux-73e82f84-94de-4d08-82a4-f22d42a1dedf
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Hmm, couldn't we use devm_add_action_or_reset() for resetting the
twl_priv pointer? Feels more clean for me.

Regards,
Andreas