[lvc-project] [PATCH v3 0/3] mfd: tps65217: Handle IRQ initialization errors

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>

The TPS65217 MFD driver does not validate the outcome of IRQ
initialisation: tps65217_probe() ignores the return value of
tps65217_irq_init(), so a failed irq_domain creation leaves the
driver bound with a NULL tps->irq_domain and the remove callback
oopses, and a failed write of the interrupt mask leaves the software
mask out of sync with the hardware.

On top of that the irq_domain is torn down in the wrong order: the
remove callback disposes the mappings and removes the domain before
the MFD children are unbound, so children that requested interrupts
(e.g. tps65217-charger) release virtual IRQs whose descriptors are
already disposed, and on probe failure the domain is leaked with its
host_data pointing to freed memory. The enable_irq_wake() in probe
is never balanced.

This series plugs the probe error paths and moves the domain and
wake-up teardown into devres, registered right after the domain is
created. Devres actions are released in reverse order of
registration, so on both removal and probe failure the MFD children
release their IRQs first, then the parent interrupt is freed and its
thread stopped, and only then is the domain removed.

Changes since v2:
 - Replace "Fix irq_domain leak and use-after-free on probe failure"
   with "Use devres for IRQ domain and wake teardown". The domain
   teardown is a devres action registered before the parent
   interrupt, so it is released after devm_request_threaded_irq()
   has freed the interrupt and stopped the threaded handler. This
   closes the window flagged in review, in which a late interrupt
   could run the handler against a removed or NULL irq_domain, and
   makes the manual disable_irq()/synchronize_irq() on the error
   path unnecessary.
 - Drop "Fix NULL pointer dereference in remove callback", now
   obsolete: the remove callback is gone.
 - Added "From" to the body of the patches to avoid checkpatch.pl
   email name mismatch error.

Radiy Zhambakiev (3):
  mfd: tps65217: Fix NULL pointer dereference on IRQ init failure
  mfd: tps65217: Check return value when masking interrupt sources
  mfd: tps65217: Use devres for IRQ domain and wake teardown

 drivers/mfd/tps65217.c | 81 +++++++++++++++++++++++++++++++-----------
 1 file changed, 60 insertions(+), 21 deletions(-)

-- 
2.55.0