Re: [PATCH v2] usb: typec: tcpci_rt1711h: unregister TCPCI port with devres

[Heikki Krogerus]

On Mon, Jul 06, 2026 at 11:53:12PM +0900, Myeonghun Pak wrote:
> rt1711h_probe() registers the TCPCI port before requesting the interrupt
> and enabling alert interrupts. If either of those later steps fails, the
> probe function returns without unregistering the TCPCI port. The explicit
> unregister currently only happens from the remove callback.
> 
> Register a devres action immediately after tcpci_register_port() succeeds,
> so tcpci_unregister_port() runs on later probe failures and on driver
> detach. Drop the remove callback to avoid unregistering the same port
> twice.
> 
> This issue was identified during our ongoing static-analysis research while
> reviewing kernel code.
> 
> Fixes: 302c570bf36e ("usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
> Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
> Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>

Acked-by: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>

> ---
> v2:
> - Add Cc: stable@xxxxxxxxxxxxxxx.
> 
>  drivers/usb/typec/tcpm/tcpci_rt1711h.c | 13 ++++++++-----
>  1 file changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/usb/typec/tcpm/tcpci_rt1711h.c b/drivers/usb/typec/tcpm/tcpci_rt1711h.c
> index a8726da6fc71..20037ef130ca 100644
> --- a/drivers/usb/typec/tcpm/tcpci_rt1711h.c
> +++ b/drivers/usb/typec/tcpm/tcpci_rt1711h.c
> @@ -298,2 +298,4 @@
> +static void rt1711h_unregister_tcpci_port(void *tcpci);
> +
>  static int rt1711h_probe(struct i2c_client *client)
>  {
> @@ -339,7 +341,11 @@ static int rt1711h_probe(struct i2c_client *client)
>  	chip->tcpci = tcpci_register_port(chip->dev, &chip->data);
>  	if (IS_ERR_OR_NULL(chip->tcpci))
>  		return PTR_ERR(chip->tcpci);
> +
> +	ret = devm_add_action_or_reset(chip->dev, rt1711h_unregister_tcpci_port, chip->tcpci);
> +	if (ret)
> +		return ret;
>  
>  	ret = devm_request_threaded_irq(chip->dev, client->irq, NULL,
>  					rt1711h_irq,
>  					IRQF_ONESHOT | IRQF_TRIGGER_LOW,
> @@ -357,11 +363,9 @@ static int rt1711h_probe(struct i2c_client *client)
>  	return 0;
>  }
>  
> -static void rt1711h_remove(struct i2c_client *client)
> +static void rt1711h_unregister_tcpci_port(void *tcpci)
>  {
> -	struct rt1711h_chip *chip = i2c_get_clientdata(client);
> -
> -	tcpci_unregister_port(chip->tcpci);
> +	tcpci_unregister_port(tcpci);
>  }
>  
>  static const struct rt1711h_chip_info rt1711h = {
> @@ -394,7 +396,6 @@ static struct i2c_driver rt1711h_i2c_driver = {
>  		.of_match_table = rt1711h_of_match,
>  	},
>  	.probe = rt1711h_probe,
> -	.remove = rt1711h_remove,
>  	.id_table = rt1711h_id,
>  };
>  module_i2c_driver(rt1711h_i2c_driver);
> -- 
> 2.47.1

-- 
heikki