Re: [PATCH 3/6] mfd: palmas: Fix potential IRQ action leaks on removal

[Lee Jones <lee@kernel.org>]

On Sat, 31 Oct 2026, Guangshuo Li wrote:

> The remove callback deletes the IRQ chip before managed OF children
> are removed. Their later free_irq() calls cannot find the disposed IRQ
> descriptors, potentially leaking interrupt actions. Depopulate the
> children before deleting the IRQ chip and auxiliary I2C clients.
>
> This issue was found by our static analysis tool under development.
>
> Fixes: 124e9deb1c40 ("mfd: palmas: Use devm_of_platform_populate()")
> Cc: stable@vger.kernel.org
> Assisted-by: OpenAI:gpt-6-astra
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
> ---
> Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
> and the driver dependencies (W=1).
> No runtime or fault-injection testing was performed.
>
>  drivers/mfd/palmas.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/mfd/palmas.c b/drivers/mfd/palmas.c
> index 7fc886f4f80e..8a0b7b1e89d7 100644
> --- a/drivers/mfd/palmas.c
> +++ b/drivers/mfd/palmas.c
> @@ -677,6 +677,9 @@ static void palmas_i2c_remove(struct i2c_client *i2c)
>  	struct palmas *palmas = i2c_get_clientdata(i2c);
>  	int i;
>
> +	if (i2c->dev.of_node)
> +		devm_of_platform_depopulate(&i2c->dev);

I think it would be nice to devm_* regmap_add_irq_chip() instead.

If you also convert the auxiliary I2C clients and 'pm_power_off'
teardown to devm, you could drop palmas_i2c_remove() altogether.

> +
>  	regmap_del_irq_chip(palmas->irq, palmas->irq_data);
>
>  	for (i = 1; i < PALMAS_NUM_CLIENTS; i++) {

-- 
Lee Jones