[PATCH 4/6] mfd: stmpe: Fix potential use-after-free during removal

[Guangshuo Li]

stmpe_remove() frees the IRQ domain before removing its children.
Deactivating a child's interrupt can then access the freed domain.
Remove the children before tearing down the domain and supplies.

This issue was found by our static analysis tool under development.

Fixes: 57bf2a312ab2 ("mfd: stmpe: Remove IRQ domain upon removal")
Cc: stable at vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo at mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 defconfig plus COMPILE_TEST
and the driver dependencies (W=1).
No runtime or fault-injection testing was performed.

 drivers/mfd/stmpe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index 3c5c2f157f52..89c1c8deadc6 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -1486,6 +1486,8 @@ EXPORT_SYMBOL_GPL(stmpe_probe);
 
 void stmpe_remove(struct stmpe *stmpe)
 {
+	mfd_remove_devices(stmpe->dev);
+
 	if (stmpe->domain)
 		irq_domain_remove(stmpe->domain);
 
@@ -1495,8 +1497,6 @@ void stmpe_remove(struct stmpe *stmpe)
 		regulator_disable(stmpe->vcc);
 
 	__stmpe_disable(stmpe, STMPE_BLOCK_ADC);
-
-	mfd_remove_devices(stmpe->dev);
 }
 EXPORT_SYMBOL_GPL(stmpe_remove);