Browse Source

soc: swr-mstr: Fix KW issue in swrm_remove

Irq pointer is first freed and then used in
irq_set_trigger_type and set wakeup capable.
This may lead to Null pointer dereference if
irq is NULL. Free irq after using it.

Change-Id: I86339e9995922cc8111f12593eb781226bb07a2a
Signed-off-by: Vatsal Bucha <[email protected]>
Vatsal Bucha 4 years ago
parent
commit
269c76b335
1 changed files with 6 additions and 6 deletions
  1. 6 6
      soc/swr-mstr-ctrl.c

+ 6 - 6
soc/swr-mstr-ctrl.c

@@ -2727,13 +2727,13 @@ err_mstr_fail:
 		swrm->reg_irq(swrm->handle, swr_mstr_interrupt,
 				swrm, SWR_IRQ_FREE);
 	} else if (swrm->irq) {
-		free_irq(swrm->irq, swrm);
 		irqd_set_trigger_type(
 			irq_get_irq_data(swrm->irq),
 			IRQ_TYPE_NONE);
+		if (swrm->swr_irq_wakeup_capable)
+			irq_set_irq_wake(swrm->irq, 0);
+		free_irq(swrm->irq, swrm);
 	}
-	if (swrm->swr_irq_wakeup_capable)
-		irq_set_irq_wake(swrm->irq, 0);
 err_irq_fail:
 	mutex_destroy(&swrm->irq_lock);
 	mutex_destroy(&swrm->mlock);
@@ -2757,15 +2757,15 @@ static int swrm_remove(struct platform_device *pdev)
 		swrm->reg_irq(swrm->handle, swr_mstr_interrupt,
 				swrm, SWR_IRQ_FREE);
 	} else if (swrm->irq) {
-		free_irq(swrm->irq, swrm);
 		irqd_set_trigger_type(
 			irq_get_irq_data(swrm->irq),
 			IRQ_TYPE_NONE);
+		if (swrm->swr_irq_wakeup_capable)
+			irq_set_irq_wake(swrm->irq, 0);
+		free_irq(swrm->irq, swrm);
 	} else if (swrm->wake_irq > 0) {
 		free_irq(swrm->wake_irq, swrm);
 	}
-	if (swrm->swr_irq_wakeup_capable)
-		irq_set_irq_wake(swrm->irq, 0);
 	cancel_work_sync(&swrm->wakeup_work);
 	pm_runtime_disable(&pdev->dev);
 	pm_runtime_set_suspended(&pdev->dev);