Re: [PATCH v2 13/27] mfd: twl-core: Clear twl_priv pointer on teardown and probe failure

[Lee Jones]

On Wed, 28 Oct 2026, Andreas Kemnade wrote:

> On Tue, 27 Oct 2026 09:30:42 +0000
> Lee Jones <lee@xxxxxxxxxx> wrote:
> 
> > twl_probe() allocates the file-scope twl_priv state with devm_kzalloc()
> > and checks for a non-NULL twl_priv at entry to reject multiple device
> > instances.  However, twl_remove() and the early error paths in
> > twl_probe() never reset twl_priv to NULL, a failure when adding MFD
> > child devices bypasses twl_remove() by jumping to free instead of fail,
> > and twl_remove() tears down the IRQ domain and dummy I2C clients before
> > child devices are unregistered.  After devres frees the underlying
> > memory on probe failure or unbind, twl_priv remains a dangling pointer,
> > causing subsequent exported API calls to dereference freed memory and
> > blocking future probe attempts with -EBUSY.
> > 
> > Unregister DT-populated and MFD child devices at the start of
> > twl_remove(), ensure mfd_add_devices() failures unwind via fail, and
> > reset twl_priv to NULL in twl_remove() and on probe error exit.
> > 
> > Fixes: 80a97ccd33be ("mfd: twl-core: Collect global variables behind one private structure (global)")
> > Closes: https://sashiko.dev/#/bug/linux-73e82f84-94de-4d08-82a4-f22d42a1dedf
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
> 
> Hmm, couldn't we use devm_add_action_or_reset() for resetting the
> twl_priv pointer? Feels more clean for me.

Nice!  Thanks for the suggestion.

To keep this fix minimal for Stable backporting (and avoid resending a
27-patch series), I'll take this one as-is and send a follow-up patch
converting twl_priv to use devm_add_action_or_reset().

-- 
Lee Jones