From: Sergio Paracuellos Date: Fri, 26 Jun 2026 06:01:10 +0000 (+0200) Subject: gpio: mt7621: more robust management of IRQ domain teardown X-Git-Tag: v7.2-rc2~17^2~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=839738536adabae1a7e98ed3fc332ce9cc991d27;p=thirdparty%2Fkernel%2Flinux.git gpio: mt7621: more robust management of IRQ domain teardown The driver uses devm_gpiochip_add_data() to register the GPIO chips which means the devres subsystem will unregister them only after the function 'mt7621_gpio_remove()' returns. During the window between domain destruction and devres unregistering the GPIO chips, the chips are still fully active. If a consumer or userspace invokes gpiod_to_irq() during this window, 'mt7621_gpio_to_irq()' can dereference the already-freed irq domain pointer. Thus, manage the IRQ domain teardown using 'devm_add_action_or_reset()' to guarantee it is destroyed strictly after the GPIO chips are removed. Cc: stable@vger.kernel.org Reported-by: Sashiko Fixes: a46f2e5720f5 ("gpio: mt7621: fix interrupt banks mapping on gpio chips") Signed-off-by: Sergio Paracuellos Link: https://patch.msgid.link/20260626060112.2498324-3-sergio.paracuellos@gmail.com Signed-off-by: Bartosz Golaszewski --- diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c index ceb99641baee..57384ef74703 100644 --- a/drivers/gpio/gpio-mt7621.c +++ b/drivers/gpio/gpio-mt7621.c @@ -272,9 +272,9 @@ static const struct irq_chip mt7621_irq_chip = { }; static void -mt7621_gpio_remove(struct platform_device *pdev) +mt7621_gpio_remove(void *data) { - struct mtk *priv = platform_get_drvdata(pdev); + struct mtk *priv = data; int offset, virq; if (priv->gpio_irq > 0) @@ -475,14 +475,14 @@ mediatek_gpio_probe(struct platform_device *pdev) if (mtk->gpio_irq > 0) { ret = mt7621_gpio_irq_setup(pdev, mtk); if (ret) - goto fail; + return ret; } - return 0; + ret = devm_add_action_or_reset(dev, mt7621_gpio_remove, mtk); + if (ret) + return ret; -fail: - mt7621_gpio_remove(pdev); - return ret; + return 0; } static const struct of_device_id mediatek_gpio_match[] = { @@ -493,7 +493,6 @@ MODULE_DEVICE_TABLE(of, mediatek_gpio_match); static struct platform_driver mediatek_gpio_driver = { .probe = mediatek_gpio_probe, - .remove = mt7621_gpio_remove, .driver = { .name = "mt7621_gpio", .of_match_table = mediatek_gpio_match,