Re: [PATCH v2 13/27] mfd: twl-core: Clear twl_priv pointer on teardown and probe failure

[Andreas Kemnade]

On Tue, 27 Oct 2026 09:30:42 +0000
Lee Jones <lee@xxxxxxxxxx> wrote:

> twl_probe() allocates the file-scope twl_priv state with devm_kzalloc()
> and checks for a non-NULL twl_priv at entry to reject multiple device
> instances.  However, twl_remove() and the early error paths in
> twl_probe() never reset twl_priv to NULL, a failure when adding MFD
> child devices bypasses twl_remove() by jumping to free instead of fail,
> and twl_remove() tears down the IRQ domain and dummy I2C clients before
> child devices are unregistered.  After devres frees the underlying
> memory on probe failure or unbind, twl_priv remains a dangling pointer,
> causing subsequent exported API calls to dereference freed memory and
> blocking future probe attempts with -EBUSY.
> 
> Unregister DT-populated and MFD child devices at the start of
> twl_remove(), ensure mfd_add_devices() failures unwind via fail, and
> reset twl_priv to NULL in twl_remove() and on probe error exit.
> 
> Fixes: 80a97ccd33be ("mfd: twl-core: Collect global variables behind one private structure (global)")
> Closes: https://sashiko.dev/#/bug/linux-73e82f84-94de-4d08-82a4-f22d42a1dedf
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Lee Jones <lee@xxxxxxxxxx>

Hmm, couldn't we use devm_add_action_or_reset() for resetting the
twl_priv pointer? Feels more clean for me.

Regards,
Andreas