[PATCH] Input: da9055_onkey - free the requested IRQ on removal

[Myeonghun Pak]

platform_get_irq_byname() returns the Linux IRQ number already
translated by the MFD core. The probe path requests this IRQ directly,
but remove passes it through regmap_irq_get_virq() again as a chip-local
index.

This can access beyond the chip IRQ table or yield a different IRQ, so
the requested ONKEY interrupt is not released. An interrupt after the
work cancellation can then access the unregistered input device or queue
work referencing the freed onkey state.

Remove the second translation so free_irq() stops the same producer that
probe installed before the delayed work and input device are torn down.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: 06491e84f0f9 ("Input: da9055_onkey - remove use of regmap_irq_get_virq()")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>

---
Compile-tested with Clang, W=1. No hardware runtime testing.

Based on mainline 0fcb05b72344f40806cbe810de8872f1698bf053.

diff --git a/drivers/input/misc/da9055_onkey.c b/drivers/input/misc/da9055_onkey.c
index 3e4fc2f..20ee79a 100644
--- a/drivers/input/misc/da9055_onkey.c
+++ b/drivers/input/misc/da9055_onkey.c
@@ -137,7 +137,6 @@ static void da9055_onkey_remove(struct platform_device *pdev)
 	struct da9055_onkey *onkey = platform_get_drvdata(pdev);
 	int irq = platform_get_irq_byname(pdev, "ONKEY");
 
-	irq = regmap_irq_get_virq(onkey->da9055->irq_data, irq);
 	free_irq(irq, onkey);
 	cancel_delayed_work_sync(&onkey->work);
 	input_unregister_device(onkey->input);