[PATCH 1/6] mfd: da9055: Fix potential use-after-free during removal

[Guangshuo Li]

da9055_device_exit() deletes the IRQ chip before removing its children.
The onkey driver's remove callback then uses the freed IRQ-chip data to
look up its interrupt number. Remove the children before deleting the
IRQ chip.

This issue was found by our static analysis tool under development.

Fixes: 2896434cf272 ("mfd: DA9055 core driver")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/da9055-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mfd/da9055-core.c b/drivers/mfd/da9055-core.c
index 158590ad37d4..72820c153f23 100644
--- a/drivers/mfd/da9055-core.c
+++ b/drivers/mfd/da9055-core.c
@@ -393,8 +393,8 @@ int da9055_device_init(struct da9055 *da9055)
 
 void da9055_device_exit(struct da9055 *da9055)
 {
-	regmap_del_irq_chip(da9055->chip_irq, da9055->irq_data);
 	mfd_remove_devices(da9055->dev);
+	regmap_del_irq_chip(da9055->chip_irq, da9055->irq_data);
 }
 
 MODULE_DESCRIPTION("Core support for the DA9055 PMIC");