gpio: mt7621: more robust management of IRQ domain teardown

The driver uses devm_gpiochip_add_data() to register the GPIO chips which
means the devres subsystem will unregister them only after the function
'mt7621_gpio_remove()' returns. During the window between domain destruction
and devres unregistering the GPIO chips, the chips are still fully active.
If a consumer or userspace invokes gpiod_to_irq() during this window,
'mt7621_gpio_to_irq()' can dereference the already-freed irq domain pointer.
Thus, manage the IRQ domain teardown using 'devm_add_action_or_reset()' to
guarantee it is destroyed strictly after the GPIO chips are removed.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: a46f2e5720f5 ("gpio: mt7621: fix interrupt banks mapping on gpio chips")
Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
Link: https://patch.msgid.link/20260626060112.2498324-3-sergio.paracuellos@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c
index ceb99641baeeb2e074990b0fc3d580911cc05d7c..57384ef74703902e66bd1f5a2597513fe4f95a48 100644 (file)
--- a/drivers/gpio/gpio-mt7621.c
+++ b/drivers/gpio/gpio-mt7621.c
@@ -272,9 +272,9 @@ static const struct irq_chip mt7621_irq_chip = {
 };
 
 static void
-mt7621_gpio_remove(struct platform_device *pdev)
+mt7621_gpio_remove(void *data)
 {
-       struct mtk *priv = platform_get_drvdata(pdev);
+       struct mtk *priv = data;
        int offset, virq;
 
        if (priv->gpio_irq > 0)
@@ -475,14 +475,14 @@ mediatek_gpio_probe(struct platform_device *pdev)
        if (mtk->gpio_irq > 0) {
                ret = mt7621_gpio_irq_setup(pdev, mtk);
                if (ret)
-                       goto fail;
+                       return ret;
        }
 
-       return 0;
+       ret = devm_add_action_or_reset(dev, mt7621_gpio_remove, mtk);
+       if (ret)
+               return ret;
 
-fail:
-       mt7621_gpio_remove(pdev);
-       return ret;
+       return 0;
 }
 
 static const struct of_device_id mediatek_gpio_match[] = {
@@ -493,7 +493,6 @@ MODULE_DEVICE_TABLE(of, mediatek_gpio_match);
 
 static struct platform_driver mediatek_gpio_driver = {
        .probe = mediatek_gpio_probe,
-       .remove = mt7621_gpio_remove,
        .driver = {
                .name = "mt7621_gpio",
                .of_match_table = mediatek_gpio_match,