[PATCH 05/28] mfd: bd96801: Allocate watchdog IRQ resource on the heap

[Lee Jones]

bd96801_i2c_probe() declares struct resource wdg_irq on the stack and
assigns its address to ddata->cells[WDG_CELL].resources.  Although
mfd_add_device() deep-copies the resource table via
platform_device_add_resources() before bd96801_i2c_probe() returns, the
shared cell template and the shallow MFD cell copy attached to the child
platform device retain a stale pointer to the expired stack frame.

Allocate wdg_irq on the heap via devm_kzalloc() alongside regulator_res
so the stored pointer remains valid for the lifetime of the device.

Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---
 drivers/mfd/rohm-bd96801.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/mfd/rohm-bd96801.c b/drivers/mfd/rohm-bd96801.c
index 66fa017ad568..eb7a7376ea89 100644
--- a/drivers/mfd/rohm-bd96801.c
+++ b/drivers/mfd/rohm-bd96801.c
@@ -642,8 +642,7 @@ static int bd96801_i2c_probe(struct i2c_client *i2c)
 	struct irq_domain *intb_domain, *errb_domain;
 	const struct bd968xx *ddata;
 	const struct fwnode_handle *fwnode;
-	struct resource *regulator_res;
-	struct resource wdg_irq;
+	struct resource *regulator_res, *wdg_irq;
 	struct regmap *regmap;
 	int intb_irq, errb_irq, num_errb = 0;
 	int num_regu_irqs, wdg_irq_no;
@@ -692,6 +691,10 @@ static int bd96801_i2c_probe(struct i2c_client *i2c)
 	if (!regulator_res)
 		return -ENOMEM;
 
+	wdg_irq = devm_kzalloc(&i2c->dev, sizeof(*wdg_irq), GFP_KERNEL);
+	if (!wdg_irq)
+		return -ENOMEM;
+
 	regmap = devm_regmap_init_i2c(i2c, ddata->regmap_config);
 	if (IS_ERR(regmap))
 		return dev_err_probe(&i2c->dev, PTR_ERR(regmap),
@@ -723,9 +726,9 @@ static int bd96801_i2c_probe(struct i2c_client *i2c)
 	}
 
 	wdg_irq_no = irq_create_mapping(intb_domain, BD96801_WDT_ERR_STAT);
-	wdg_irq = DEFINE_RES_IRQ_NAMED(wdg_irq_no, "bd96801-wdg");
+	*wdg_irq = DEFINE_RES_IRQ_NAMED(wdg_irq_no, "bd96801-wdg");
 
-	ddata->cells[WDG_CELL].resources = &wdg_irq;
+	ddata->cells[WDG_CELL].resources = wdg_irq;
 	ddata->cells[WDG_CELL].num_resources = 1;
 
 	if (!num_errb)
-- 
2.56.0.218.g1ec904b173-goog