[PATCH 0/5] mfd: Fix an out-of-bounds IRQ map and error-path bugs

From: shao.mingyin

Date: Sat Nov 07 2026 - 03:07:57 EST


Five independent fixes in the MFD core address an out-of-bounds IRQ-map
lookup, an uninitialized interrupt-mask write, an IRQ leak on a failed
probe, a missing IRQ-wake teardown on removal, and two unchecked
firmware CRC reads. Each patch touches a different driver; they are
grouped only because they go through the same MFD tree. Every patch is
independent and can be applied and reviewed on its own, and taking a
subset is fine.

The series is ordered by severity:

1/5 mfd: tps65219: Fix out-of-bounds access in tps65214 IRQ map
2/5 mfd: twl6030-irq: Don't write garbage to interrupt mask on read failure
3/5 mfd: arizona: Free info IRQs on probe failure
4/5 mfd: da9052: Disable IRQ wake on device removal
5/5 mfd: gateworks-gsc: Check firmware CRC reads for errors

1/5 adds the missing reserved-bit placeholder so that a power-button
interrupt no longer indexes past tps65214_sub_irq_offsets[]. 2/5
returns the I2C read error instead of writing uninitialized stack data
to the PMIC interrupt mask. 3/5 frees the three informational IRQs
before arizona_irq_exit() tears down their domain. 4/5 tracks whether
enable_irq_wake() succeeded and disables it on the probe failure and
removal paths. 5/5 checks the two GSC_FW_CRC reads and fails the probe
instead of printing a stale CRC.

No dependencies; all five apply directly on next-20261030.

Shao Mingyin (5):
mfd: tps65219: Fix out-of-bounds access in tps65214 IRQ map
mfd: twl6030-irq: Don't write garbage to interrupt mask on read failure
mfd: arizona: Free info IRQs on probe failure
mfd: da9052: Disable IRQ wake on device removal
mfd: gateworks-gsc: Check firmware CRC reads for errors

drivers/mfd/arizona-core.c | 3 +++
drivers/mfd/da9052-irq.c | 11 ++++++++++-
drivers/mfd/gateworks-gsc.c | 6 ++++--
drivers/mfd/tps65219.c | 1 +
drivers/mfd/twl6030-irq.c | 10 ++++++----
include/linux/mfd/da9052/da9052.h | 2 ++
6 files changed, 26 insertions(+), 7 deletions(-)

---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c