Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 269c76b3 authored by Vatsal Bucha's avatar Vatsal Bucha
Browse files

soc: swr-mstr: Fix KW issue in swrm_remove 



Irq pointer is first freed and then used in
irq_set_trigger_type and set wakeup capable.
This may lead to Null pointer dereference if
irq is NULL. Free irq after using it.

Change-Id: I86339e9995922cc8111f12593eb781226bb07a2a
Signed-off-by: default avatarVatsal Bucha <vbucha@codeaurora.org>
parent 06ed8063

soc/swr-mstr-ctrl.c

+6 −6
Original line number Diff line number Diff line
@@ -2727,13 +2727,13 @@ static int swrm_probe(struct platform_device *pdev) 
		swrm->reg_irq(swrm->handle, swr_mstr_interrupt,

				swrm, SWR_IRQ_FREE);

	} else if (swrm->irq) {

		free_irq(swrm->irq, swrm);

		irqd_set_trigger_type(

			irq_get_irq_data(swrm->irq),

			IRQ_TYPE_NONE);

	}

		if (swrm->swr_irq_wakeup_capable)

			irq_set_irq_wake(swrm->irq, 0);

		free_irq(swrm->irq, swrm);

	}

err_irq_fail:

	mutex_destroy(&swrm->irq_lock);

	mutex_destroy(&swrm->mlock);
@@ -2757,15 +2757,15 @@ static int swrm_remove(struct platform_device *pdev) 
		swrm->reg_irq(swrm->handle, swr_mstr_interrupt,

				swrm, SWR_IRQ_FREE);

	} else if (swrm->irq) {

		free_irq(swrm->irq, swrm);

		irqd_set_trigger_type(

			irq_get_irq_data(swrm->irq),

			IRQ_TYPE_NONE);

		if (swrm->swr_irq_wakeup_capable)

			irq_set_irq_wake(swrm->irq, 0);

		free_irq(swrm->irq, swrm);

	} else if (swrm->wake_irq > 0) {

		free_irq(swrm->wake_irq, swrm);

	}

	if (swrm->swr_irq_wakeup_capable)

		irq_set_irq_wake(swrm->irq, 0);

	cancel_work_sync(&swrm->wakeup_work);

	pm_runtime_disable(&pdev->dev);

	pm_runtime_set_suspended(&pdev->dev);