The threaded IRQ handler queues hpd_work. The work accesses the regmap
and calls drm_bridge_hpd_notify(), so it must not run after the bridge or
the devm-allocated driver data has been released.
Free the IRQ before cancelling hpd_work so the handler cannot queue the
work again. Do this in remove and when adv7533_attach_dsi() fails after
the IRQ has been registered.
The remove-side race was reported previously, but the proposed fix did
not cover the late probe failure path.
This issue was found by a static analysis tool.
Fixes: 518cb7057a59 ("drm/bridge: adv7511: Use work_struct to defer hotplug
handing to out of irq context")
Reported-by: Zheng Wang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Hongyan Xu <[email protected]>
---
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index 02f8f7e78..132ec4793 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -1400,11 +1400,15 @@ static int adv7511_probe(struct i2c_client *i2c)
if (adv7511->info->has_dsi) {
ret = adv7533_attach_dsi(adv7511);
if (ret)
- goto err_unregister_audio;
+ goto err_free_irq;
}
return 0;
+err_free_irq:
+ if (i2c->irq)
+ devm_free_irq(dev, i2c->irq, adv7511);
+ cancel_work_sync(&adv7511->hpd_work);
err_unregister_audio:
drm_bridge_remove(&adv7511->bridge);
i2c_unregister_device(adv7511->i2c_cec);
@@ -1425,6 +1429,10 @@ static void adv7511_remove(struct i2c_client *i2c)
{
struct adv7511 *adv7511 = i2c_get_clientdata(i2c);
+ if (i2c->irq)
+ devm_free_irq(&i2c->dev, i2c->irq, adv7511);
+ cancel_work_sync(&adv7511->hpd_work);
+
of_node_put(adv7511->host_node);
adv7511_uninit_regulators(adv7511);
--
2.50.1.windows.1
