[PATCH v2 25/27] mfd: mt6397: Unregister PM notifier on probe failure and unbind

[Chen-Yu Tsai]

On Tue, Oct 27, 2026 at 6:38 PM Lee Jones <lee at kernel.org> wrote:
>
> mt6397_irq_init() registers a power management notifier block embedded
> in the devres-managed struct mt6397_chip via register_pm_notifier(),
> but never unregisters it if mt6397_probe() later fails or when the
> driver is unbound.  Once devres frees struct mt6397_chip, the dangling
> notifier block corrupts the global PM notifier chain and causes a
> use-after-free on subsequent suspend or resume transitions.
>
> Check the return value of register_pm_notifier() and register a devres
> action to unregister the PM notifier on probe failure or device unbind.
>
> Fixes: 4e2e7cfec13a ("mfd: mt6397: Modify suspend/resume behavior")
> Closes: https://sashiko.dev/#/bug/linux-edb62fbc-213a-49a2-be55-c002e234e554
> Cc: stable at vger.kernel.org
> Signed-off-by: Lee Jones <lee at kernel.org>

Reviewed-by: Chen-Yu Tsai <wenst at chromium.org>

Though in practice, if one hits this then they have bigger problems.