[PATCH v2 00/27] mfd: Assorted resource lifetime, teardown, and error-handling fixes
From: Lee Jones
Date: Tue Oct 27 2026 - 06:37:14 EST
These issues were reported by Sashiko.
This series addresses a collection of resource lifetime, teardown
ordering, error-handling, and bounds-checking bugs across several MFD
drivers.
v1 => v2:
- Collected Acked-by, Reviewed-by, and Tested-by tags from the list
- Dropped "mfd: cgbc: Zero-initialise version buffer in
cgbc_get_version()" in favour of Thomas Richard's upcoming central
cgbc_command() validation series
- Restored Fixes: tags (without Cc: stable@xxxxxxxxxxxxxxx) on the four
non-Stable MFD cell stack-pointer clean-ups (ls2kbmc, bd96801,
ti_am335x_tscadc, and db8500-prcmu)
Cc: Aaro Koskinen <aaro.koskinen@xxxxxx>
Cc: Andi Shyti <andi.shyti@xxxxxxxxxx>
Cc: Andreas Kemnade <andreas@xxxxxxxxxxxx>
Cc: Andy Shevchenko <andy@xxxxxxxxxx>
Cc: AngeloGioacchino Del Regno <angelogioacchino.delregno@xxxxxxxxxxxxx>
Cc: AnilKumar Ch <anilkumar@xxxxxx>
Cc: Arnd Bergmann <arnd@xxxxxxxx>
Cc: Binbin Zhou <zhoubinbin@xxxxxxxxxxx>
Cc: Brent Casavant <bcasavan@xxxxxxx>
Cc: Chong Qiao <qiaochong@xxxxxxxxxxx>
Cc: Corey Minyard <corey@xxxxxxxxxxx>
Cc: David Lechner <dlechner@xxxxxxxxxxxx>
Cc: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
Cc: Felipe Balbi <balbi@xxxxxx>
Cc: Gyungoh Yoo <jack.yoo@xxxxxxxxxxxx>
Cc: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
Cc: Hsin-Hsiung Wang <hsin-hsiung.wang@xxxxxxxxxxxx>
Cc: Huacai Chen <chenhuacai@xxxxxxxxxx>
Cc: Jarkko Nikula <jarkko.nikula@xxxxxxxxxxxxxxx>
Cc: Jonathan Cameron <jic23@xxxxxxxxxx>
Cc: Joshua Kinard <linux@xxxxxxxxx>
Cc: Kai Svahn <kai.svahn@xxxxxxxxx>
Cc: Kevin Hilman <khilman@xxxxxxxxxxxx>
Cc: Kumar Sanghvi <kumar.sanghvi@xxxxxxxxxxxxxx>
Cc: Linus Walleij <linusw@xxxxxxxxxx>
Cc: linux-arm-kernel@xxxxxxxxxxxxxxxxxxx
Cc: linux-crypto@xxxxxxxxxxxxxxx
Cc: linux-i2c@xxxxxxxxxxxxxxx
Cc: linux-iio@xxxxxxxxxxxxxxx
Cc: linux-input@xxxxxxxxxxxxxxx
Cc: linux-mediatek@xxxxxxxxxxxxxxxxxxx
Cc: linux-omap@xxxxxxxxxxxxxxx
Cc: Matthias Brugger <matthias.bgg@xxxxxxxxx>
Cc: Mattias Nilsson <mattias.i.nilsson@xxxxxxxxxxxxxx>
Cc: Mattias Wallin <mattias.wallin@xxxxxxxxxxxxxx>
Cc: Matti Vaittinen <mazziesaccount@xxxxxxxxx>
Cc: mfd@xxxxxxxxxxxxxxx
Cc: Mika Westerberg <mika.westerberg@xxxxxxxxxxxxxxx>
Cc: Milo Kim <woogyom.kim@xxxxxxxxx>
Cc: Ming Yu <tmyu0@xxxxxxxxxxx>
Cc: "Nuno Sá" <nuno.sa@xxxxxxxxxx>
Cc: Pantelis Antoniou <panto@xxxxxxxxxxxxxxxxxxxxxxx>
Cc: Pat Gefre <pfg@xxxxxxx>
Cc: Paul Burton <paulburton@xxxxxxxxxx>
Cc: Peter Ujfalusi <peter.ujfalusi@xxxxxx>
Cc: Qunqin Zhao <zhaoqunqin@xxxxxxxxxxx>
Cc: Rabin Vincent <rabin.vincent@xxxxxxxxxxxxxx>
Cc: Rachna Patil <rachna@xxxxxx>
Cc: Roger Quadros <rogerq@xxxxxxxxxx>
Cc: Samuel Ortiz <sameo@xxxxxxxxxxxxxxx>
Cc: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
Cc: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
Cc: Shi Hao <i.shihao.999@xxxxxxxxx>
Cc: Srinidhi Kasagar <srinidhi.kasagar@xxxxxxxxxxxxxx>
Cc: Stanislaw Skowronek <skylark@xxxxxxxxxxxxx>
Cc: Stephen Warren <swarren@xxxxxxxxxx>
Cc: Sundar Iyer <sundar.iyer@xxxxxxxxxxxxxx>
Cc: syed khasim <x0khasim@xxxxxx>
Cc: Thomas Bogendoerfer <tbogendoerfer@xxxxxxx>
Cc: Thomas Richard <thomas.richard@xxxxxxxxxxx>
Cc: Tony Lindgren <tony@xxxxxxxxxxx>
Cc: Yinggang Gu <guyinggang@xxxxxxxxxxx>
Lee Jones (27):
mfd: nct6694: Allocate USB DMA buffers with kzalloc_obj()
mfd: ls2kbmc: Unregister GPIO GSI via devm_add_action_or_reset()
mfd: ls2kbmc: Cancel reset work on teardown via devm_work_autocancel()
mfd: ls2kbmc: Allocate simplefb platform_data on the heap
mfd: bd96801: Allocate watchdog IRQ resource on the heap
mfd: ti_am335x_tscadc: Retrieve parent driver data via
dev_get_drvdata()
mfd: db8500-prcmu: Make AB8500 cell and IRQ resource static
mfd: nct6694: Do not resubmit interrupt URB on endpoint stall (-EPIPE)
mfd: ioc3: Request parent IRQ via request_irq() and free before domain
removal
mfd: intel-lpss: Remove registered MFD child devices on probe failure
mfd: max8907: Manage power-off handler via
devm_register_sys_off_handler()
mfd: twl-core: Clear pm_power_off callback in twl_remove()
mfd: twl-core: Clear twl_priv pointer on teardown and probe failure
mfd: loongson-se: Check return value of dma_set_mask_and_coherent()
mfd: loongson-se: Zero-initialise controller command structures
mfd: loongson-se: Reinitialise completions and wait uninterruptibly
for commands
mfd: loongson-se: Zero-allocate driver data and initialise engine
completions in probe
mfd: loongson-se: Prevent out-of-bounds engine access in
se_irq_handler()
mfd: loongson-se: Stop controller and mask interrupts on teardown and
shutdown
mfd: loongson-se: Validate engine ID, DMA buffer size, and IRQ
registration
mfd: abx500-core: Unregister device ops on devm release
mfd: ab8500-core: Register sysfs attribute groups via
devm_device_add_group()
mfd: tps65217: Manage IRQ domain teardown via devres
mfd: mt6397: Manage IRQ domain lifecycle with devres
mfd: mt6397: Unregister PM notifier on probe failure and unbind
i2c: cgbc: Propagate hardware errors when polling read status
mfd: ti_am335x_tscadc: Remove redundant ti_tscadc_dev_get() helper
drivers/i2c/busses/i2c-cgbc.c | 27 ++++--
drivers/iio/adc/ti_am335x_adc.c | 2 +-
drivers/input/touchscreen/ti_am335x_tsc.c | 2 +-
drivers/mfd/ab8500-core.c | 11 +--
drivers/mfd/abx500-core.c | 29 +++---
drivers/mfd/db8500-prcmu.c | 8 +-
drivers/mfd/intel-lpss.c | 1 +
drivers/mfd/ioc3.c | 32 ++++---
drivers/mfd/loongson-se.c | 110 +++++++++++++++++-----
drivers/mfd/ls2k-bmc-core.c | 27 ++++--
drivers/mfd/max8907.c | 28 ++++--
drivers/mfd/mt6358-irq.c | 17 +++-
drivers/mfd/mt6397-core.c | 4 +-
drivers/mfd/mt6397-irq.c | 31 +++++-
drivers/mfd/nct6694.c | 23 +++--
drivers/mfd/rohm-bd96801.c | 11 ++-
drivers/mfd/ti_am335x_tscadc.c | 7 +-
drivers/mfd/tps65217.c | 40 ++++----
drivers/mfd/twl-core.c | 45 +++++----
include/linux/mfd/loongson-se.h | 8 +-
include/linux/mfd/ti_am335x_tscadc.h | 7 --
21 files changed, 326 insertions(+), 144 deletions(-)
--
2.56.0.307.g5fe7bd680c-goog