[PATCH 2/6] mfd: atc260x: Fix potential use-after-free on probe failure

[Guangshuo Li]

The IRQ chip is device-managed, but the child registration failure path
also deletes it explicitly. Subsequent devres cleanup can then access
the freed IRQ-chip data. Let devres perform the IRQ-chip teardown.

This issue was found by our static analysis tool under development.

Fixes: f7cb7fe34db9 ("mfd: Add MFD driver for ATC260x PMICs")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/atc260x-core.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/mfd/atc260x-core.c b/drivers/mfd/atc260x-core.c
index 6b6d5f1b9d76..da233b6482fc 100644
--- a/drivers/mfd/atc260x-core.c
+++ b/drivers/mfd/atc260x-core.c
@@ -292,10 +292,8 @@ int atc260x_device_probe(struct atc260x *atc260x)
 	ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE,
 				   atc260x->cells, atc260x->nr_cells, NULL, 0,
 				   regmap_irq_get_domain(atc260x->irq_data));
-	if (ret) {
+	if (ret)
 		dev_err(dev, "Failed to add child devices: %d\n", ret);
-		regmap_del_irq_chip(atc260x->irq, atc260x->irq_data);
-	}
 
 	return ret;
 }