[PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[Guangshuo Li]

hi655x_pmic_remove() currently removes the regmap IRQ chip before
removing the MFD child devices. regmap_del_irq_chip() disposes the
child IRQ mappings and removes their IRQ descriptors.

The hi65xx-powerkey child registers interrupt handlers using
devm_request_any_context_irq(). During child device removal, the
device-managed cleanup calls free_irq(), but the corresponding IRQ
descriptors are no longer available. As a result, the allocated
struct irqaction objects referenced by irq_desc->action are not
freed, causing a memory leak.

Remove the MFD child devices first, allowing their device-managed
IRQ handlers to be released while the IRQ mappings are still valid.
Then remove the regmap IRQ chip and its IRQ domain.

This issue was found by our static analysis tool under development.

Fixes: eb10245fb37e ("mfd: hi655x-pmic: Add powerkey device to hi655x PMIC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/mfd/hi655x-pmic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
index 5cb392892c19..3a7ccc9d30b7 100644
--- a/drivers/mfd/hi655x-pmic.c
+++ b/drivers/mfd/hi655x-pmic.c
@@ -147,8 +147,8 @@ static void hi655x_pmic_remove(struct platform_device *pdev)
 {
 	struct hi655x_pmic *pmic = platform_get_drvdata(pdev);
 
-	regmap_del_irq_chip(gpiod_to_irq(pmic->gpio), pmic->irq_data);
 	mfd_remove_devices(&pdev->dev);
+	regmap_del_irq_chip(gpiod_to_irq(pmic->gpio), pmic->irq_data);
 }
 
 static const struct of_device_id hi655x_pmic_match[] = {
-- 
2.43.0

Re: [PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[Krzysztof Kozlowski]

On 27/10/2026 03:46, Guangshuo Li wrote:
> hi655x_pmic_remove() currently removes the regmap IRQ chip before
> removing the MFD child devices. regmap_del_irq_chip() disposes the
> child IRQ mappings and removes their IRQ descriptors.
> 
> The hi65xx-powerkey child registers interrupt handlers using
> devm_request_any_context_irq(). During child device removal, the
> device-managed cleanup calls free_irq(), but the corresponding IRQ
> descriptors are no longer available. As a result, the allocated
> struct irqaction objects referenced by irq_desc->action are not
> freed, causing a memory leak.
> 
> Remove the MFD child devices first, allowing their device-managed
> IRQ handlers to be released while the IRQ mappings are still valid.
> Then remove the regmap IRQ chip and its IRQ domain.
> 
> This issue was found by our static analysis tool under development.

More of postings by bot ignoring any feedback.

Best regards,
Krzysztof

Re: [PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[Guangshuo Li]

Hi Krzysztof,

On Tue, 27 Oct 2026 at 23:27, Krzysztof Kozlowski <krzk@kernel.org> wrote:
>
> On 27/10/2026 03:46, Guangshuo Li wrote:
> > hi655x_pmic_remove() currently removes the regmap IRQ chip before
> > removing the MFD child devices. regmap_del_irq_chip() disposes the
> > child IRQ mappings and removes their IRQ descriptors.
> >
> > The hi65xx-powerkey child registers interrupt handlers using
> > devm_request_any_context_irq(). During child device removal, the
> > device-managed cleanup calls free_irq(), but the corresponding IRQ
> > descriptors are no longer available. As a result, the allocated
> > struct irqaction objects referenced by irq_desc->action are not
> > freed, causing a memory leak.
> >
> > Remove the MFD child devices first, allowing their device-managed
> > IRQ handlers to be released while the IRQ mappings are still valid.
> > Then remove the regmap IRQ chip and its IRQ domain.
> >
> > This issue was found by our static analysis tool under development.
>
> More of postings by bot ignoring any feedback.
>
> Best regards,
> Krzysztof

Thank you for your feedback, and I apologize if our recent submissions
gave the impression that we were ignoring your previous comments.

We did take your earlier suggestions into account and subsequently
submitted a patch series accordingly.

For the more recent patches, however, since they address issues in
different drivers, we thought it would be more appropriate to submit
them separately rather than group them into a single series.

We certainly did not intend to disregard your feedback. We appreciate
your time and guidance, and we will be more careful with our future
submissions.

Thank you for your understanding.

Best regards,
Guangshuo Li

Re: [PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[Lee Jones]

On Tue, 27 Oct 2026, Krzysztof Kozlowski wrote:

> On 27/10/2026 03:46, Guangshuo Li wrote:
> > hi655x_pmic_remove() currently removes the regmap IRQ chip before
> > removing the MFD child devices. regmap_del_irq_chip() disposes the
> > child IRQ mappings and removes their IRQ descriptors.
> > 
> > The hi65xx-powerkey child registers interrupt handlers using
> > devm_request_any_context_irq(). During child device removal, the
> > device-managed cleanup calls free_irq(), but the corresponding IRQ
> > descriptors are no longer available. As a result, the allocated
> > struct irqaction objects referenced by irq_desc->action are not
> > freed, causing a memory leak.
> > 
> > Remove the MFD child devices first, allowing their device-managed
> > IRQ handlers to be released while the IRQ mappings are still valid.
> > Then remove the regmap IRQ chip and its IRQ domain.
> > 
> > This issue was found by our static analysis tool under development.
> 
> More of postings by bot ignoring any feedback.

What did I miss?

This person seems to be answering to my feedback:

https://lore.kernel.org/r/CANUHTR9B84LoCjOtS5N5qGO0KXSXUbZkrKZ3_GFTwXmVoPQ0SA@mail.gmail.com

-- 
Lee Jones

Re: [PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[Lee Jones]

On Tue, 27 Oct 2026, Guangshuo Li wrote:

> hi655x_pmic_remove() currently removes the regmap IRQ chip before
> removing the MFD child devices. regmap_del_irq_chip() disposes the
> child IRQ mappings and removes their IRQ descriptors.
> 
> The hi65xx-powerkey child registers interrupt handlers using
> devm_request_any_context_irq(). During child device removal, the
> device-managed cleanup calls free_irq(), but the corresponding IRQ
> descriptors are no longer available. As a result, the allocated
> struct irqaction objects referenced by irq_desc->action are not
> freed, causing a memory leak.
> 
> Remove the MFD child devices first, allowing their device-managed
> IRQ handlers to be released while the IRQ mappings are still valid.
> Then remove the regmap IRQ chip and its IRQ domain.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: eb10245fb37e ("mfd: hi655x-pmic: Add powerkey device to hi655x PMIC driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/mfd/hi655x-pmic.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
> index 5cb392892c19..3a7ccc9d30b7 100644
> --- a/drivers/mfd/hi655x-pmic.c
> +++ b/drivers/mfd/hi655x-pmic.c
> @@ -147,8 +147,8 @@ static void hi655x_pmic_remove(struct platform_device *pdev)
>  {
>  	struct hi655x_pmic *pmic = platform_get_drvdata(pdev);
>  
> -	regmap_del_irq_chip(gpiod_to_irq(pmic->gpio), pmic->irq_data);
>  	mfd_remove_devices(&pdev->dev);
> +	regmap_del_irq_chip(gpiod_to_irq(pmic->gpio), pmic->irq_data);

What about devm_regmap_add_irq_chip() and devm_mfd_*()?

>  }
>  
>  static const struct of_device_id hi655x_pmic_match[] = {
> -- 
> 2.43.0
> 

-- 
Lee Jones

Re: [PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[Guangshuo Li]

Hi Lee,

Thank you for your suggestion.

On Wed, 28 Oct 2026 at 00:25, Lee Jones <lee@kernel.org> wrote:
>
> On Tue, 27 Oct 2026, Guangshuo Li wrote:
>
> > hi655x_pmic_remove() currently removes the regmap IRQ chip before
> > removing the MFD child devices. regmap_del_irq_chip() disposes the
> > child IRQ mappings and removes their IRQ descriptors.
> >
> > The hi65xx-powerkey child registers interrupt handlers using
> > devm_request_any_context_irq(). During child device removal, the
> > device-managed cleanup calls free_irq(), but the corresponding IRQ
> > descriptors are no longer available. As a result, the allocated
> > struct irqaction objects referenced by irq_desc->action are not
> > freed, causing a memory leak.
> >
> > Remove the MFD child devices first, allowing their device-managed
> > IRQ handlers to be released while the IRQ mappings are still valid.
> > Then remove the regmap IRQ chip and its IRQ domain.
> >
> > This issue was found by our static analysis tool under development.
> >
> > Fixes: eb10245fb37e ("mfd: hi655x-pmic: Add powerkey device to hi655x PMIC driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > ---
> >  drivers/mfd/hi655x-pmic.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
> > index 5cb392892c19..3a7ccc9d30b7 100644
> > --- a/drivers/mfd/hi655x-pmic.c
> > +++ b/drivers/mfd/hi655x-pmic.c
> > @@ -147,8 +147,8 @@ static void hi655x_pmic_remove(struct platform_device *pdev)
> >  {
> >       struct hi655x_pmic *pmic = platform_get_drvdata(pdev);
> >
> > -     regmap_del_irq_chip(gpiod_to_irq(pmic->gpio), pmic->irq_data);
> >       mfd_remove_devices(&pdev->dev);
> > +     regmap_del_irq_chip(gpiod_to_irq(pmic->gpio), pmic->irq_data);
>
> What about devm_regmap_add_irq_chip() and devm_mfd_*()?
>
> >  }
> >
> >  static const struct of_device_id hi655x_pmic_match[] = {
> > --
> > 2.43.0
> >
>
> --
> Lee Jones

I agree that using devm_regmap_add_irq_chip() and
devm_mfd_add_devices() would be a cleaner and more appropriate
approach, as it would allow the resource cleanup order to be managed
automatically.

I'll look into this approach and update the patch accordingly.

Thanks again for your guidance.

Best regards,
Guangshuo Li

Re: [PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[Krzysztof Kozlowski]

On 27/10/2026 17:23, Lee Jones wrote:
> On Tue, 27 Oct 2026, Krzysztof Kozlowski wrote:
> 
>> On 27/10/2026 03:46, Guangshuo Li wrote:
>>> hi655x_pmic_remove() currently removes the regmap IRQ chip before
>>> removing the MFD child devices. regmap_del_irq_chip() disposes the
>>> child IRQ mappings and removes their IRQ descriptors.
>>>
>>> The hi65xx-powerkey child registers interrupt handlers using
>>> devm_request_any_context_irq(). During child device removal, the
>>> device-managed cleanup calls free_irq(), but the corresponding IRQ
>>> descriptors are no longer available. As a result, the allocated
>>> struct irqaction objects referenced by irq_desc->action are not
>>> freed, causing a memory leak.
>>>
>>> Remove the MFD child devices first, allowing their device-managed
>>> IRQ handlers to be released while the IRQ mappings are still valid.
>>> Then remove the regmap IRQ chip and its IRQ domain.
>>>
>>> This issue was found by our static analysis tool under development.
>>
>> More of postings by bot ignoring any feedback.
> 
> What did I miss?
> 
> This person seems to be answering to my feedback:
> 
> https://lore.kernel.org/r/CANUHTR9B84LoCjOtS5N5qGO0KXSXUbZkrKZ3_GFTwXmVoPQ0SA@mail.gmail.com

To mine not really. This all is again spread patch-per-patch, exactly
like I asked to fix last time, more than once.

Best regards,
Krzysztof