[PATCH 0/6] mfd: Fix potential cleanup ordering and lifetime bugs

[PATCH 0/6] mfd: Fix potential cleanup ordering and lifetime bugs

[Guangshuo Li]

Remove child devices while their IRQ providers are still available, and
avoid deleting a managed IRQ chip twice.

The changed driver objects were build-tested. No hardware testing was
performed.

Guangshuo Li (6):
  mfd: da9055: Fix potential use-after-free during removal
  mfd: atc260x: Fix potential use-after-free on probe failure
  mfd: palmas: Fix potential IRQ action leaks on removal
  mfd: stmpe: Fix potential use-after-free during removal
  mfd: stmfx: Fix potential IRQ action leaks on removal
  mfd: wm8994: Fix potential use-after-free during removal

 drivers/mfd/atc260x-core.c | 4 +---
 drivers/mfd/da9055-core.c  | 2 +-
 drivers/mfd/palmas.c       | 3 +++
 drivers/mfd/stmfx.c        | 8 +++++---
 drivers/mfd/stmpe.c        | 4 ++--
 drivers/mfd/wm8994-core.c  | 7 +++++--
 6 files changed, 17 insertions(+), 11 deletions(-)


base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3

[PATCH 1/6] mfd: da9055: Fix potential use-after-free during removal

[Guangshuo Li]

da9055_device_exit() deletes the IRQ chip before removing its children.
The onkey driver's remove callback then uses the freed IRQ-chip data to
look up its interrupt number. Remove the children before deleting the
IRQ chip.

This issue was found by our static analysis tool under development.

Fixes: 2896434cf272 ("mfd: DA9055 core driver")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/da9055-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/da9055-core.c b/drivers/mfd/da9055-core.c
index 158590ad37d4..72820c153f23 100644
--- a/drivers/mfd/da9055-core.c
+++ b/drivers/mfd/da9055-core.c
@@ -393,8 +393,8 @@ int da9055_device_init(struct da9055 *da9055)
 
 void da9055_device_exit(struct da9055 *da9055)
 {
-	regmap_del_irq_chip(da9055->chip_irq, da9055->irq_data);
 	mfd_remove_devices(da9055->dev);
+	regmap_del_irq_chip(da9055->chip_irq, da9055->irq_data);
 }
 
 MODULE_DESCRIPTION("Core support for the DA9055 PMIC");

[PATCH 2/6] mfd: atc260x: Fix potential use-after-free on probe failure

[Guangshuo Li]

The IRQ chip is device-managed, but the child registration failure path
also deletes it explicitly. Subsequent devres cleanup can then access
the freed IRQ-chip data. Let devres perform the IRQ-chip teardown.

This issue was found by our static analysis tool under development.

Fixes: f7cb7fe34db9 ("mfd: Add MFD driver for ATC260x PMICs")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/atc260x-core.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/mfd/atc260x-core.c b/drivers/mfd/atc260x-core.c
index 6b6d5f1b9d76..da233b6482fc 100644
--- a/drivers/mfd/atc260x-core.c
+++ b/drivers/mfd/atc260x-core.c
@@ -292,10 +292,8 @@ int atc260x_device_probe(struct atc260x *atc260x)
 	ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
 				   atc260x->cells, atc260x->nr_cells, NULL, 0,
 				   regmap_irq_get_domain(atc260x->irq_data));
-	if (ret) {
+	if (ret)
 		dev_err(dev, "Failed to add child devices: %d\n", ret);
-		regmap_del_irq_chip(atc260x->irq, atc260x->irq_data);
-	}
 
 	return ret;
 }

[PATCH 3/6] mfd: palmas: Fix potential IRQ action leaks on removal

[Guangshuo Li]

The remove callback deletes the IRQ chip before managed OF children
are removed. Their later free_irq() calls cannot find the disposed IRQ
descriptors, potentially leaking interrupt actions. Depopulate the
children before deleting the IRQ chip and auxiliary I2C clients.

This issue was found by our static analysis tool under development.

Fixes: 124e9deb1c40 ("mfd: palmas: Use devm_of_platform_populate()")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/palmas.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mfd/palmas.c b/drivers/mfd/palmas.c
index 7fc886f4f80e..8a0b7b1e89d7 100644
--- a/drivers/mfd/palmas.c
+++ b/drivers/mfd/palmas.c
@@ -677,6 +677,9 @@ static void palmas_i2c_remove(struct i2c_client *i2c)
 	struct palmas *palmas = i2c_get_clientdata(i2c);
 	int i;
 
+	if (i2c->dev.of_node)
+		devm_of_platform_depopulate(&i2c->dev);
+
 	regmap_del_irq_chip(palmas->irq, palmas->irq_data);
 
 	for (i = 1; i < PALMAS_NUM_CLIENTS; i++) {

[PATCH 4/6] mfd: stmpe: Fix potential use-after-free during removal

[Guangshuo Li]

stmpe_remove() frees the IRQ domain before removing its children.
Deactivating a child's interrupt can then access the freed domain.
Remove the children before tearing down the domain and supplies.

This issue was found by our static analysis tool under development.

Fixes: 57bf2a312ab2 ("mfd: stmpe: Remove IRQ domain upon removal")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/stmpe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index 3c5c2f157f52..89c1c8deadc6 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -1486,6 +1486,8 @@ EXPORT_SYMBOL_GPL(stmpe_probe);
 
 void stmpe_remove(struct stmpe *stmpe)
 {
+	mfd_remove_devices(stmpe->dev);
+
 	if (stmpe->domain)
 		irq_domain_remove(stmpe->domain);
 
@@ -1495,8 +1497,6 @@ void stmpe_remove(struct stmpe *stmpe)
 		regulator_disable(stmpe->vcc);
 
 	__stmpe_disable(stmpe, STMPE_BLOCK_ADC);
-
-	mfd_remove_devices(stmpe->dev);
 }
 EXPORT_SYMBOL_GPL(stmpe_remove);
 

[PATCH 5/6] mfd: stmfx: Fix potential IRQ action leaks on removal

[Guangshuo Li]

The remove callback disposes IRQ mappings before device-managed MFD
children are removed. Their later free_irq() calls cannot find the IRQ
descriptors, potentially leaking interrupt actions. Remove the children
explicitly before tearing down the IRQ domain.

This issue was found by our static analysis tool under development.

Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/stmfx.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
index f683fdb6ece6..82e81e084795 100644
--- a/drivers/mfd/stmfx.c
+++ b/drivers/mfd/stmfx.c
@@ -448,9 +448,9 @@ static int stmfx_probe(struct i2c_client *client)
 	if (ret)
 		goto err_chip_exit;
 
-	ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
-				   stmfx_cells, ARRAY_SIZE(stmfx_cells), NULL,
-				   0, stmfx->irq_domain);
+	ret = mfd_add_devices(dev, PLATFORM_DEVID_NONE,
+			      stmfx_cells, ARRAY_SIZE(stmfx_cells), NULL,
+			      0, stmfx->irq_domain);
 	if (ret)
 		goto err_irq_exit;
 
@@ -466,6 +466,8 @@ static int stmfx_probe(struct i2c_client *client)
 
 static void stmfx_remove(struct i2c_client *client)
 {
+	mfd_remove_devices(&client->dev);
+
 	stmfx_irq_exit(client);
 
 	stmfx_chip_exit(client);

[PATCH 6/6] mfd: wm8994: Fix potential use-after-free during removal

[Guangshuo Li]

The IRQ chip is deleted before the codec child is removed. The codec's
IRQ cleanup can then use the freed IRQ-chip data to look up interrupt
numbers. Remove normal children before deleting the IRQ chip, and keep
the LDO children until their regulator consumers have been released.
Use late removal on probe failure as well to clean up the LDO children.

This issue was found by our static analysis tool under development.

Fixes: bb63f7d33d35 ("mfd: wm8994-core: Disable regulators before removing them")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/wm8994-core.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index 094c0b3dbd97..9dbc8dbaeff2 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -29,11 +29,13 @@
 static const struct mfd_cell wm8994_regulator_devs[] = {
 	{
 		.name = "wm8994-ldo",
+		.level = MFD_DEP_LEVEL_HIGH,
 		.id = 0,
 		.pm_runtime_no_callbacks = true,
 	},
 	{
 		.name = "wm8994-ldo",
+		.level = MFD_DEP_LEVEL_HIGH,
 		.id = 1,
 		.pm_runtime_no_callbacks = true,
 	},
@@ -586,7 +588,7 @@ static int wm8994_device_init(struct wm8994 *wm8994, int irq)
 err_regulator_free:
 	regulator_bulk_free(wm8994->num_supplies, wm8994->supplies);
 err:
-	mfd_remove_devices(wm8994->dev);
+	mfd_remove_devices_late(wm8994->dev);
 	return ret;
 }
 
@@ -595,10 +597,11 @@ static void wm8994_device_exit(struct wm8994 *wm8994)
 	pm_runtime_get_sync(wm8994->dev);
 	pm_runtime_disable(wm8994->dev);
 	pm_runtime_put_noidle(wm8994->dev);
+	mfd_remove_devices(wm8994->dev);
 	wm8994_irq_exit(wm8994);
 	regulator_bulk_disable(wm8994->num_supplies, wm8994->supplies);
 	regulator_bulk_free(wm8994->num_supplies, wm8994->supplies);
-	mfd_remove_devices(wm8994->dev);
+	mfd_remove_devices_late(wm8994->dev);
 }
 
 static const struct of_device_id wm8994_of_match[] = {