[PATCH] mfd: hi655x-pmic: fix IRQ action memory leak on removal

[Guangshuo Li]

hi655x_pmic_remove() currently removes the regmap IRQ chip before
removing the MFD child devices. regmap_del_irq_chip() disposes the
child IRQ mappings and removes their IRQ descriptors.

The hi65xx-powerkey child registers interrupt handlers using
devm_request_any_context_irq(). During child device removal, the
device-managed cleanup calls free_irq(), but the corresponding IRQ
descriptors are no longer available. As a result, the allocated
struct irqaction objects referenced by irq_desc->action are not
freed, causing a memory leak.

Remove the MFD child devices first, allowing their device-managed
IRQ handlers to be released while the IRQ mappings are still valid.
Then remove the regmap IRQ chip and its IRQ domain.

This issue was found by our static analysis tool under development.

Fixes: eb10245fb37e ("mfd: hi655x-pmic: Add powerkey device to hi655x PMIC driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/mfd/hi655x-pmic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
index 5cb392892c19..3a7ccc9d30b7 100644
--- a/drivers/mfd/hi655x-pmic.c
+++ b/drivers/mfd/hi655x-pmic.c
@@ -147,8 +147,8 @@ static void hi655x_pmic_remove(struct platform_device *pdev)
 {
 	struct hi655x_pmic *pmic = platform_get_drvdata(pdev);
 
-	regmap_del_irq_chip(gpiod_to_irq(pmic->gpio), pmic->irq_data);
 	mfd_remove_devices(&pdev->dev);
+	regmap_del_irq_chip(gpiod_to_irq(pmic->gpio), pmic->irq_data);
 }
 
 static const struct of_device_id hi655x_pmic_match[] = {
-- 
2.43.0