soc: swr-mstr: Fix KW issue in swrm_remove
Irq pointer is first freed and then used in
irq_set_trigger_type and set wakeup capable.
This may lead to Null pointer dereference if
irq is NULL. Free irq after using it.
Change-Id: I86339e9995922cc8111f12593eb781226bb07a2a
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
diff --git a/soc/swr-mstr-ctrl.c b/soc/swr-mstr-ctrl.c
index 73439ee..beaaa26 100644
--- a/soc/swr-mstr-ctrl.c
+++ b/soc/swr-mstr-ctrl.c
@@ -2828,13 +2828,14 @@
swrm->reg_irq(swrm->handle, swr_mstr_interrupt,
swrm, SWR_IRQ_FREE);
} else if (swrm->irq) {
+ if (irq_get_irq_data(swrm->irq) != NULL)
+ irqd_set_trigger_type(
+ irq_get_irq_data(swrm->irq),
+ IRQ_TYPE_NONE);
+ if (swrm->swr_irq_wakeup_capable)
+ irq_set_irq_wake(swrm->irq, 0);
free_irq(swrm->irq, swrm);
- irqd_set_trigger_type(
- irq_get_irq_data(swrm->irq),
- IRQ_TYPE_NONE);
}
- if (swrm->swr_irq_wakeup_capable)
- irq_set_irq_wake(swrm->irq, 0);
err_irq_fail:
mutex_destroy(&swrm->irq_lock);
mutex_destroy(&swrm->mlock);
@@ -2858,15 +2859,16 @@
swrm->reg_irq(swrm->handle, swr_mstr_interrupt,
swrm, SWR_IRQ_FREE);
} else if (swrm->irq) {
+ if (irq_get_irq_data(swrm->irq) != NULL)
+ irqd_set_trigger_type(
+ irq_get_irq_data(swrm->irq),
+ IRQ_TYPE_NONE);
+ if (swrm->swr_irq_wakeup_capable)
+ irq_set_irq_wake(swrm->irq, 0);
free_irq(swrm->irq, swrm);
- irqd_set_trigger_type(
- irq_get_irq_data(swrm->irq),
- IRQ_TYPE_NONE);
} else if (swrm->wake_irq > 0) {
free_irq(swrm->wake_irq, swrm);
}
- if (swrm->swr_irq_wakeup_capable)
- irq_set_irq_wake(swrm->irq, 0);
cancel_work_sync(&swrm->wakeup_work);
pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);