Re: [PATCH] rtc: mpc5121: convert from irq_of_parse_and_map to platform_get_irq

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:

Pre-existing issues:
- [High] Devm LIFO ordering causes a potential Use-After-Free of `rtc->rtc`=
 during probe failure or device removal.
--

--- Patch [1]: [PATCH] rtc: mpc5121: convert from irq_of_parse_and_map to p=
latform_get_irq ---
[Note: The standard review format has been altered to a free-form summary d=
ue to recitation restrictions. No code diffs are quoted.]

commit 67266c7661895f337b8df1626c97434560227e94
Author: Rosen Penev <[email protected]>

rtc: mpc5121: convert from irq_of_parse_and_map to platform_get_irq

This commit converts the driver to use platform_get_irq instead of
irq_of_parse_and_map, removing the need for explicit irq_dispose_mapping
calls during teardown.

[Severity: High]
This is a pre-existing issue, but does the ordering of devres allocations
create a use-after-free hazard during teardown?

In mpc5121_rtc_probe(), devm_request_irq() is called before
devm_rtc_allocate_device(). Because the devres framework tears down resourc=
es
in LIFO order, during a probe failure or device removal, the RTC device
structure will be freed before the IRQ is unregistered and synchronized.

While mpc5121_rtc_remove() disables hardware interrupts, it does not wait f=
or
currently executing handlers to finish. If an in-flight interrupt on another
CPU executes mpc5121_rtc_handler() during this teardown window, it will
access the already freed rtc->rtc pointer.

Could the IRQ requests be moved after the RTC device allocation to ensure t=
he
IRQ handler is properly unregistered and synchronized before the RTC device
is freed?

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260728004519.5739=
[email protected]?part=3D1