github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

gpio: mt7621: more robust management of IRQ domain teardown

Browse Source 
The driver uses devm_gpiochip_add_data() to register the GPIO chips which
means the devres subsystem will unregister them only after the function
'mt7621_gpio_remove()' returns. During the window between domain destruction
and devres unregistering the GPIO chips, the chips are still fully active.
If a consumer or userspace invokes gpiod_to_irq() during this window,
'mt7621_gpio_to_irq()' can dereference the already-freed irq domain pointer.
Thus, manage the IRQ domain teardown using 'devm_add_action_or_reset()' to
guarantee it is destroyed strictly after the GPIO chips are removed.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: a46f2e5720 ("gpio: mt7621: fix interrupt banks mapping on gpio chips")
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Link: https://patch.msgid.link/20260626060112.2498324-3-sergio.paracuellos@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
This commit is contained in:
Sergio Paracuellos 2026-06-26 08:01:10 +02:00 committed by Bartosz Golaszewski
parent 1781172526
commit 839738536a
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/gpio/gpio-mt7621.c
View File

@ -272,9 +272,9 @@ static const struct irq_chip mt7621_irq_chip = {
};
static void
mt7621_gpio_remove(struct platform_device *pdev)
mt7621_gpio_remove(void *data)
{
struct mtk *priv = platform_get_drvdata(pdev);
struct mtk *priv = data;
int offset, virq;
if (priv->gpio_irq > 0)
@ -475,14 +475,14 @@ mediatek_gpio_probe(struct platform_device *pdev)
if (mtk->gpio_irq > 0) {
ret = mt7621_gpio_irq_setup(pdev, mtk);
if (ret)
goto fail;
return ret;
}
return 0;
ret = devm_add_action_or_reset(dev, mt7621_gpio_remove, mtk);
if (ret)
return ret;
fail:
mt7621_gpio_remove(pdev);
return ret;
return 0;
}
static const struct of_device_id mediatek_gpio_match[] = {
@ -493,7 +493,6 @@ MODULE_DEVICE_TABLE(of, mediatek_gpio_match);
static struct platform_driver mediatek_gpio_driver = {
.probe = mediatek_gpio_probe,
.remove = mt7621_gpio_remove,
.driver = {
.name = "mt7621_gpio",
.of_match_table = mediatek_gpio_match,