Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

soc: swr-mstr: Fix KW issue in swrm_remove

Browse source 
Irq pointer is first freed and then used in
irq_set_trigger_type and set wakeup capable.
This may lead to Null pointer dereference if
irq is NULL. Free irq after using it.

Change-Id: I86339e9995922cc8111f12593eb781226bb07a2a
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
This commit is contained in:
Vatsal Bucha 2020-06-18 08:57:27 +05:30
parent 686ed22ea7
commit 9dd9516429
1 changed files with 12 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
soc/swr-mstr-ctrl.c
View file

@ -2828,13 +2828,14 @@ static int swrm_probe(struct platform_device *pdev)
swrm->reg_irq(swrm->handle, swr_mstr_interrupt,
swrm, SWR_IRQ_FREE);
} else if (swrm->irq) {
if (irq_get_irq_data(swrm->irq) != NULL)
irqd_set_trigger_type(
irq_get_irq_data(swrm->irq),
IRQ_TYPE_NONE);
if (swrm->swr_irq_wakeup_capable)
irq_set_irq_wake(swrm->irq, 0);
free_irq(swrm->irq, swrm);
irqd_set_trigger_type(
irq_get_irq_data(swrm->irq),
IRQ_TYPE_NONE);
}
if (swrm->swr_irq_wakeup_capable)
irq_set_irq_wake(swrm->irq, 0);
err_irq_fail:
mutex_destroy(&swrm->irq_lock);
mutex_destroy(&swrm->mlock);
@ -2858,15 +2859,16 @@ static int swrm_remove(struct platform_device *pdev)
swrm->reg_irq(swrm->handle, swr_mstr_interrupt,
swrm, SWR_IRQ_FREE);
} else if (swrm->irq) {
if (irq_get_irq_data(swrm->irq) != NULL)
irqd_set_trigger_type(
irq_get_irq_data(swrm->irq),
IRQ_TYPE_NONE);
if (swrm->swr_irq_wakeup_capable)
irq_set_irq_wake(swrm->irq, 0);
free_irq(swrm->irq, swrm);
irqd_set_trigger_type(
irq_get_irq_data(swrm->irq),
IRQ_TYPE_NONE);
} else if (swrm->wake_irq > 0) {
free_irq(swrm->wake_irq, swrm);
}
if (swrm->swr_irq_wakeup_capable)
irq_set_irq_wake(swrm->irq, 0);
cancel_work_sync(&swrm->wakeup_work);
pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);