[PATCH] Input: da9055_onkey - free the requested IRQ on removal

[PATCH] Input: da9055_onkey - free the requested IRQ on removal

[Myeonghun Pak]

platform_get_irq_byname() returns the Linux IRQ number already
translated by the MFD core. The probe path requests this IRQ directly,
but remove passes it through regmap_irq_get_virq() again as a chip-local
index.

This can access beyond the chip IRQ table or yield a different IRQ, so
the requested ONKEY interrupt is not released. An interrupt after the
work cancellation can then access the unregistered input device or queue
work referencing the freed onkey state.

Remove the second translation so free_irq() stops the same producer that
probe installed before the delayed work and input device are torn down.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: 06491e84f0f9 ("Input: da9055_onkey - remove use of regmap_irq_get_virq()")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>

---
Compile-tested with Clang, W=1. No hardware runtime testing.

Based on mainline 0fcb05b72344f40806cbe810de8872f1698bf053.

diff --git a/drivers/input/misc/da9055_onkey.c b/drivers/input/misc/da9055_onkey.c
index 3e4fc2f..20ee79a 100644
--- a/drivers/input/misc/da9055_onkey.c
+++ b/drivers/input/misc/da9055_onkey.c
@@ -137,7 +137,6 @@ static void da9055_onkey_remove(struct platform_device *pdev)
 	struct da9055_onkey *onkey = platform_get_drvdata(pdev);
 	int irq = platform_get_irq_byname(pdev, "ONKEY");
 
-	irq = regmap_irq_get_virq(onkey->da9055->irq_data, irq);
 	free_irq(irq, onkey);
 	cancel_delayed_work_sync(&onkey->work);
 	input_unregister_device(onkey->input);

Re: [PATCH] Input: da9055_onkey - free the requested IRQ on removal

[Dmitry Torokhov]

Hi Myeonghun,

On Sat, Oct 17, 2026 at 10:56:50PM -0400, Myeonghun Pak wrote:
> platform_get_irq_byname() returns the Linux IRQ number already
> translated by the MFD core. The probe path requests this IRQ directly,
> but remove passes it through regmap_irq_get_virq() again as a chip-local
> index.
> 
> This can access beyond the chip IRQ table or yield a different IRQ, so
> the requested ONKEY interrupt is not released. An interrupt after the
> work cancellation can then access the unregistered input device or queue
> work referencing the freed onkey state.
> 
> Remove the second translation so free_irq() stops the same producer that
> probe installed before the delayed work and input device are torn down.

I think it is better to convert the driver to devm as in the patch I
just sent out, it will take care of this issue as well as make the code
simpler.

Thanks.

-- 
Dmitry