From 269c76b335cdb049a7cf7a9a452584ebe06046c8 Mon Sep 17 00:00:00 2001 From: Vatsal Bucha Date: Thu, 18 Jun 2020 08:57:27 +0530 Subject: [PATCH] soc: swr-mstr: Fix KW issue in swrm_remove Irq pointer is first freed and then used in irq_set_trigger_type and set wakeup capable. This may lead to Null pointer dereference if irq is NULL. Free irq after using it. Change-Id: I86339e9995922cc8111f12593eb781226bb07a2a Signed-off-by: Vatsal Bucha --- soc/swr-mstr-ctrl.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/soc/swr-mstr-ctrl.c b/soc/swr-mstr-ctrl.c index b9913e44804c..63c25c825292 100644 --- a/soc/swr-mstr-ctrl.c +++ b/soc/swr-mstr-ctrl.c @@ -2727,13 +2727,13 @@ err_mstr_fail: swrm->reg_irq(swrm->handle, swr_mstr_interrupt, swrm, SWR_IRQ_FREE); } else if (swrm->irq) { - free_irq(swrm->irq, swrm); irqd_set_trigger_type( irq_get_irq_data(swrm->irq), IRQ_TYPE_NONE); + if (swrm->swr_irq_wakeup_capable) + irq_set_irq_wake(swrm->irq, 0); + free_irq(swrm->irq, swrm); } - if (swrm->swr_irq_wakeup_capable) - irq_set_irq_wake(swrm->irq, 0); err_irq_fail: mutex_destroy(&swrm->irq_lock); mutex_destroy(&swrm->mlock); @@ -2757,15 +2757,15 @@ static int swrm_remove(struct platform_device *pdev) swrm->reg_irq(swrm->handle, swr_mstr_interrupt, swrm, SWR_IRQ_FREE); } else if (swrm->irq) { - free_irq(swrm->irq, swrm); irqd_set_trigger_type( irq_get_irq_data(swrm->irq), IRQ_TYPE_NONE); + if (swrm->swr_irq_wakeup_capable) + irq_set_irq_wake(swrm->irq, 0); + free_irq(swrm->irq, swrm); } else if (swrm->wake_irq > 0) { free_irq(swrm->wake_irq, swrm); } - if (swrm->swr_irq_wakeup_capable) - irq_set_irq_wake(swrm->irq, 0); cancel_work_sync(&swrm->wakeup_work); pm_runtime_disable(&pdev->dev); pm_runtime_set_suspended(&pdev->dev);