[PATCH] mfd: twl6040: fix IRQ action memory leaks during teardown

[PATCH] mfd: twl6040: fix IRQ action memory leaks during teardown

[Guangshuo Li]

twl6040_remove() currently removes the regmap IRQ chip before
removing the MFD child devices. This destroys the IRQ mappings
before the child drivers can release their interrupt handlers.

The parent driver also registers READY and thermal interrupt
handlers using devm_request_threaded_irq(). These handlers are
normally released by device-managed cleanup after remove returns,
when the corresponding IRQ descriptors have already been removed.

Consequently, free_irq() cannot find the IRQ descriptors and the
allocated struct irqaction objects are not freed. The associated
IRQ threads also cannot be stopped through the normal cleanup path.

The probe error paths have a similar issue, as they destroy the IRQ
chip before the device-managed IRQ handlers are released.

Remove the MFD child devices first, then explicitly free the
parent's READY and thermal IRQ handlers using devm_free_irq()
before removing the regmap IRQ chip.

Also update the probe error paths to release successfully requested
IRQs before destroying their mappings.

This issue was found by our static analysis tool under development.

Fixes: ab7edb149c75 ("mfd: twl6040: Convert to use regmap_irq")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/mfd/twl6040.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c
index 562a0f939f6e..7b05d21cd17d 100644
--- a/drivers/mfd/twl6040.c
+++ b/drivers/mfd/twl6040.c
@@ -745,7 +745,7 @@ static int twl6040_probe(struct i2c_client *client)
 					"twl6040_irq_th", twl6040);
 	if (ret) {
 		dev_err(twl6040->dev, "Thermal IRQ request failed: %d\n", ret);
-		goto readyirq_err;
+		goto thirq_err;
 	}
 
 	/*
@@ -791,10 +791,14 @@ static int twl6040_probe(struct i2c_client *client)
 	ret = mfd_add_devices(&client->dev, -1, twl6040->cells, children,
 			      NULL, 0, NULL);
 	if (ret)
-		goto readyirq_err;
+		goto mfd_err;
 
 	return 0;
 
+mfd_err:
+	devm_free_irq(twl6040->dev, twl6040->irq_th, twl6040);
+thirq_err:
+	devm_free_irq(twl6040->dev, twl6040->irq_ready, twl6040);
 readyirq_err:
 	regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);
 gpio_err:
@@ -809,9 +813,10 @@ static void twl6040_remove(struct i2c_client *client)
 	if (twl6040->power_count)
 		twl6040_power(twl6040, 0);
 
-	regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);
-
 	mfd_remove_devices(&client->dev);
+	devm_free_irq(twl6040->dev, twl6040->irq_th, twl6040);
+	devm_free_irq(twl6040->dev, twl6040->irq_ready, twl6040);
+	regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);
 
 	regulator_bulk_disable(TWL6040_NUM_SUPPLIES, twl6040->supplies);
 }
-- 
2.43.0

Re: [PATCH] mfd: twl6040: fix IRQ action memory leaks during teardown

[Krzysztof Kozlowski]

On 27/10/2026 04:26, Guangshuo Li wrote:
> twl6040_remove() currently removes the regmap IRQ chip before
> removing the MFD child devices. This destroys the IRQ mappings
> before the child drivers can release their interrupt handlers.
> 
> The parent driver also registers READY and thermal interrupt
> handlers using devm_request_threaded_irq(). These handlers are
> normally released by device-managed cleanup after remove returns,
> when the corresponding IRQ descriptors have already been removed.
> 
> Consequently, free_irq() cannot find the IRQ descriptors and the
> allocated struct irqaction objects are not freed. The associated
> IRQ threads also cannot be stopped through the normal cleanup path.
> 
> The probe error paths have a similar issue, as they destroy the IRQ
> chip before the device-managed IRQ handlers are released.
> 
> Remove the MFD child devices first, then explicitly free the
> parent's READY and thermal IRQ handlers using devm_free_irq()
> before removing the regmap IRQ chip.
> 
> Also update the probe error paths to release successfully requested
> IRQs before destroying their mappings.
> 

More of postings by bot ignoring any feedback.

Best regards,
Krzysztof

Re: [PATCH] mfd: twl6040: fix IRQ action memory leaks during teardown

[Guangshuo Li]

Hi Krzysztof,

On Tue, 27 Oct 2026 at 23:33, Krzysztof Kozlowski <krzk@kernel.org> wrote:
>
> On 27/10/2026 04:26, Guangshuo Li wrote:
> > twl6040_remove() currently removes the regmap IRQ chip before
> > removing the MFD child devices. This destroys the IRQ mappings
> > before the child drivers can release their interrupt handlers.
> >
> > The parent driver also registers READY and thermal interrupt
> > handlers using devm_request_threaded_irq(). These handlers are
> > normally released by device-managed cleanup after remove returns,
> > when the corresponding IRQ descriptors have already been removed.
> >
> > Consequently, free_irq() cannot find the IRQ descriptors and the
> > allocated struct irqaction objects are not freed. The associated
> > IRQ threads also cannot be stopped through the normal cleanup path.
> >
> > The probe error paths have a similar issue, as they destroy the IRQ
> > chip before the device-managed IRQ handlers are released.
> >
> > Remove the MFD child devices first, then explicitly free the
> > parent's READY and thermal IRQ handlers using devm_free_irq()
> > before removing the regmap IRQ chip.
> >
> > Also update the probe error paths to release successfully requested
> > IRQs before destroying their mappings.
> >
>
> More of postings by bot ignoring any feedback.
>
> Best regards,
> Krzysztof

Thank you for your feedback, and I apologize if our recent submissions
gave the impression that we were ignoring your previous comments.

We did take your earlier suggestions into account and subsequently
submitted a patch series accordingly.

For the more recent patches, however, since they address issues in
different drivers, we thought it would be more appropriate to submit
them separately rather than group them into a single series.

We certainly did not intend to disregard your feedback. We appreciate
your time and guidance, and we will be more careful with our future
submissions.

Thank you for your understanding.

Best regards,
Guangshuo Li

Re: [PATCH] mfd: twl6040: fix IRQ action memory leaks during teardown

[Lee Jones]

On Tue, 27 Oct 2026, Guangshuo Li wrote:

> twl6040_remove() currently removes the regmap IRQ chip before
> removing the MFD child devices. This destroys the IRQ mappings
> before the child drivers can release their interrupt handlers.
>
> The parent driver also registers READY and thermal interrupt
> handlers using devm_request_threaded_irq(). These handlers are
> normally released by device-managed cleanup after remove returns,
> when the corresponding IRQ descriptors have already been removed.
>
> Consequently, free_irq() cannot find the IRQ descriptors and the
> allocated struct irqaction objects are not freed. The associated
> IRQ threads also cannot be stopped through the normal cleanup path.
>
> The probe error paths have a similar issue, as they destroy the IRQ
> chip before the device-managed IRQ handlers are released.
>
> Remove the MFD child devices first, then explicitly free the
> parent's READY and thermal IRQ handlers using devm_free_irq()
> before removing the regmap IRQ chip.
>
> Also update the probe error paths to release successfully requested
> IRQs before destroying their mappings.
>
> This issue was found by our static analysis tool under development.
>
> Fixes: ab7edb149c75 ("mfd: twl6040: Convert to use regmap_irq")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/mfd/twl6040.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c
> index 562a0f939f6e..7b05d21cd17d 100644
> --- a/drivers/mfd/twl6040.c
> +++ b/drivers/mfd/twl6040.c
> @@ -745,7 +745,7 @@ static int twl6040_probe(struct i2c_client *client)
>  					"twl6040_irq_th", twl6040);
>  	if (ret) {
>  		dev_err(twl6040->dev, "Thermal IRQ request failed: %d\n", ret);
> -		goto readyirq_err;
> +		goto thirq_err;
>  	}
>
>  	/*
> @@ -791,10 +791,14 @@ static int twl6040_probe(struct i2c_client *client)
>  	ret = mfd_add_devices(&client->dev, -1, twl6040->cells, children,
>  			      NULL, 0, NULL);
>  	if (ret)
> -		goto readyirq_err;
> +		goto mfd_err;
>
>  	return 0;
>
> +mfd_err:
> +	devm_free_irq(twl6040->dev, twl6040->irq_th, twl6040);
> +thirq_err:
> +	devm_free_irq(twl6040->dev, twl6040->irq_ready, twl6040);
>  readyirq_err:
>  	regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);
>  gpio_err:
> @@ -809,9 +813,10 @@ static void twl6040_remove(struct i2c_client *client)
>  	if (twl6040->power_count)
>  		twl6040_power(twl6040, 0);
>
> -	regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);
> -
>  	mfd_remove_devices(&client->dev);
> +	devm_free_irq(twl6040->dev, twl6040->irq_th, twl6040);
> +	devm_free_irq(twl6040->dev, twl6040->irq_ready, twl6040);
> +	regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);

Why not use more devm_*() handlers?

devm_regmap_add_irq_chip()

devm_free* eeks me out.  The point of devm_*() is that it's managed.

>  	regulator_bulk_disable(TWL6040_NUM_SUPPLIES, twl6040->supplies);
>  }
> -- 
> 2.43.0
>

-- 
Lee Jones

Re: [PATCH] mfd: twl6040: fix IRQ action memory leaks during teardown

[Guangshuo Li]

Hi Lee,

On Wed, 28 Oct 2026 at 00:26, Lee Jones <lee@kernel.org> wrote:
>
> On Tue, 27 Oct 2026, Guangshuo Li wrote:
>
> > twl6040_remove() currently removes the regmap IRQ chip before
> > removing the MFD child devices. This destroys the IRQ mappings
> > before the child drivers can release their interrupt handlers.
> >
> > The parent driver also registers READY and thermal interrupt
> > handlers using devm_request_threaded_irq(). These handlers are
> > normally released by device-managed cleanup after remove returns,
> > when the corresponding IRQ descriptors have already been removed.
> >
> > Consequently, free_irq() cannot find the IRQ descriptors and the
> > allocated struct irqaction objects are not freed. The associated
> > IRQ threads also cannot be stopped through the normal cleanup path.
> >
> > The probe error paths have a similar issue, as they destroy the IRQ
> > chip before the device-managed IRQ handlers are released.
> >
> > Remove the MFD child devices first, then explicitly free the
> > parent's READY and thermal IRQ handlers using devm_free_irq()
> > before removing the regmap IRQ chip.
> >
> > Also update the probe error paths to release successfully requested
> > IRQs before destroying their mappings.
> >
> > This issue was found by our static analysis tool under development.
> >
> > Fixes: ab7edb149c75 ("mfd: twl6040: Convert to use regmap_irq")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > ---
> >  drivers/mfd/twl6040.c | 13 +++++++++----
> >  1 file changed, 9 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c
> > index 562a0f939f6e..7b05d21cd17d 100644
> > --- a/drivers/mfd/twl6040.c
> > +++ b/drivers/mfd/twl6040.c
> > @@ -745,7 +745,7 @@ static int twl6040_probe(struct i2c_client *client)
> >                                       "twl6040_irq_th", twl6040);
> >       if (ret) {
> >               dev_err(twl6040->dev, "Thermal IRQ request failed: %d\n", ret);
> > -             goto readyirq_err;
> > +             goto thirq_err;
> >       }
> >
> >       /*
> > @@ -791,10 +791,14 @@ static int twl6040_probe(struct i2c_client *client)
> >       ret = mfd_add_devices(&client->dev, -1, twl6040->cells, children,
> >                             NULL, 0, NULL);
> >       if (ret)
> > -             goto readyirq_err;
> > +             goto mfd_err;
> >
> >       return 0;
> >
> > +mfd_err:
> > +     devm_free_irq(twl6040->dev, twl6040->irq_th, twl6040);
> > +thirq_err:
> > +     devm_free_irq(twl6040->dev, twl6040->irq_ready, twl6040);
> >  readyirq_err:
> >       regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);
> >  gpio_err:
> > @@ -809,9 +813,10 @@ static void twl6040_remove(struct i2c_client *client)
> >       if (twl6040->power_count)
> >               twl6040_power(twl6040, 0);
> >
> > -     regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);
> > -
> >       mfd_remove_devices(&client->dev);
> > +     devm_free_irq(twl6040->dev, twl6040->irq_th, twl6040);
> > +     devm_free_irq(twl6040->dev, twl6040->irq_ready, twl6040);
> > +     regmap_del_irq_chip(twl6040->irq, twl6040->irq_data);
>
> Why not use more devm_*() handlers?
>
> devm_regmap_add_irq_chip()
>
> devm_free* eeks me out.  The point of devm_*() is that it's managed.
>
> >       regulator_bulk_disable(TWL6040_NUM_SUPPLIES, twl6040->supplies);
> >  }
> > --
> > 2.43.0
> >
>
> --
> Lee Jones

Thanks for your suggestion. I'll look into using devm_*() APIs in v2.

Would you prefer that I submit the twl6040 and hi655x-pmic fixes as a
single patch series in v2, or separately?

Best regards,
Guangshuo Li

Re: [PATCH] mfd: twl6040: fix IRQ action memory leaks during teardown

[Krzysztof Kozlowski]

On 27/10/2026 17:22, Guangshuo Li wrote:
> Hi Krzysztof,
> 
> On Tue, 27 Oct 2026 at 23:33, Krzysztof Kozlowski <krzk@kernel.org> wrote:
>>
>> On 27/10/2026 04:26, Guangshuo Li wrote:
>>> twl6040_remove() currently removes the regmap IRQ chip before
>>> removing the MFD child devices. This destroys the IRQ mappings
>>> before the child drivers can release their interrupt handlers.
>>>
>>> The parent driver also registers READY and thermal interrupt
>>> handlers using devm_request_threaded_irq(). These handlers are
>>> normally released by device-managed cleanup after remove returns,
>>> when the corresponding IRQ descriptors have already been removed.
>>>
>>> Consequently, free_irq() cannot find the IRQ descriptors and the
>>> allocated struct irqaction objects are not freed. The associated
>>> IRQ threads also cannot be stopped through the normal cleanup path.
>>>
>>> The probe error paths have a similar issue, as they destroy the IRQ
>>> chip before the device-managed IRQ handlers are released.
>>>
>>> Remove the MFD child devices first, then explicitly free the
>>> parent's READY and thermal IRQ handlers using devm_free_irq()
>>> before removing the regmap IRQ chip.
>>>
>>> Also update the probe error paths to release successfully requested
>>> IRQs before destroying their mappings.
>>>
>>
>> More of postings by bot ignoring any feedback.
>>
>> Best regards,
>> Krzysztof
> 
> Thank you for your feedback, and I apologize if our recent submissions
> gave the impression that we were ignoring your previous comments.
> 
> We did take your earlier suggestions into account and subsequently
> submitted a patch series accordingly.
> 
> For the more recent patches, however, since they address issues in
> different drivers, we thought it would be more appropriate to submit
> them separately rather than group them into a single series.

How this that differ from last time, explain me please.

Last time you sent x separate patches for subsystem foo. I asked to send
them as patchset.

Now you sent y separate patches for subsystem bar. You keep repeating
the same.

Best regards,
Krzysztof

Re: [PATCH] mfd: twl6040: fix IRQ action memory leaks during teardown

[Guangshuo Li]

Hi Krzysztof,

Thank you for your feedback.

On Wed, 28 Oct 2026 at 00:44, Krzysztof Kozlowski <krzk@kernel.org> wrote:
>
> On 27/10/2026 17:22, Guangshuo Li wrote:
> > Hi Krzysztof,
> >
> > On Tue, 27 Oct 2026 at 23:33, Krzysztof Kozlowski <krzk@kernel.org> wrote:
> >>
> >> On 27/10/2026 04:26, Guangshuo Li wrote:
> >>> twl6040_remove() currently removes the regmap IRQ chip before
> >>> removing the MFD child devices. This destroys the IRQ mappings
> >>> before the child drivers can release their interrupt handlers.
> >>>
> >>> The parent driver also registers READY and thermal interrupt
> >>> handlers using devm_request_threaded_irq(). These handlers are
> >>> normally released by device-managed cleanup after remove returns,
> >>> when the corresponding IRQ descriptors have already been removed.
> >>>
> >>> Consequently, free_irq() cannot find the IRQ descriptors and the
> >>> allocated struct irqaction objects are not freed. The associated
> >>> IRQ threads also cannot be stopped through the normal cleanup path.
> >>>
> >>> The probe error paths have a similar issue, as they destroy the IRQ
> >>> chip before the device-managed IRQ handlers are released.
> >>>
> >>> Remove the MFD child devices first, then explicitly free the
> >>> parent's READY and thermal IRQ handlers using devm_free_irq()
> >>> before removing the regmap IRQ chip.
> >>>
> >>> Also update the probe error paths to release successfully requested
> >>> IRQs before destroying their mappings.
> >>>
> >>
> >> More of postings by bot ignoring any feedback.
> >>
> >> Best regards,
> >> Krzysztof
> >
> > Thank you for your feedback, and I apologize if our recent submissions
> > gave the impression that we were ignoring your previous comments.
> >
> > We did take your earlier suggestions into account and subsequently
> > submitted a patch series accordingly.
> >
> > For the more recent patches, however, since they address issues in
> > different drivers, we thought it would be more appropriate to submit
> > them separately rather than group them into a single series.
>
> How this that differ from last time, explain me please.
>
> Last time you sent x separate patches for subsystem foo. I asked to send
> them as patchset.
>
> Now you sent y separate patches for subsystem bar. You keep repeating
> the same.
>
> Best regards,
> Krzysztof

We did follow your earlier advice and submitted a patch series, which
also received feedback from the maintainer:

Series:
https://lkml.iu.edu/2607.2/05103.html

Maintainer replies:
https://lists.openwall.net/linux-kernel/2026/09/28/2917
https://lists.openwall.net/linux-kernel/2026/09/28/2932

However, you're right about this batch. When manually sorting the
patches, we failed to group the related fixes into a series. This was
our oversight, and I sincerely apologize.

We'll be more careful and submit the related MFD fixes as a series in v2.

Best regards,
Guangshuo Li