The FIFOP interrupt handler queues cc2520_fifop_irqwork. On removal,
cc2520_remove() only flushes the work. The devm-managed FIFOP IRQ
remains active until after ->remove() returns and can queue the work
again after that flush, allowing it to run after the private data is
released.
Disable the work with disable_work_sync() instead of flushing it, so
the handler can no longer queue it once removal begins. Destroy
buffer_mutex last, since unregistering can invoke the driver's stop
callback, which uses it.
Install the SFD IRQ before cc2520_register(), so it is available when
the netdev becomes visible. Install the FIFOP IRQ afterwards, so a
registration failure cannot schedule RX work while its hardware is
being released; cc2520_register() no longer frees the hardware on its
own failure, leaving that to the probe cleanup.
Found by an in-house static analysis tool.
Fixes: 0da6bc8cc341 ("ieee802154: cc2520: adds driver for TI CC2520 radio")
Cc: [email protected] #v6.10+
Suggested-by: Miquel Raynal <[email protected]>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <[email protected]>
---
drivers/net/ieee802154/cc2520.c | 43 +++++++++++++++++++++--------------------
1 file changed, 22 insertions(+), 21 deletions(-)
Changes in v2:
- Use disable_work_sync() for the FIFOP work instead of explicitly
freeing the interrupts. Drops the interrupt-number fields and the
manual devm_free_irq() calls.
diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
index 2b7034193..1b588f8d3 100644
--- a/drivers/net/ieee802154/cc2520.c
+++ b/drivers/net/ieee802154/cc2520.c
@@ -857,12 +857,10 @@ static int cc2520_register(struct cc2520_private *priv)
dev_vdbg(&priv->spi->dev, "registered cc2520\n");
ret = ieee802154_register_hw(priv->hw);
if (ret)
- goto err_free_device;
+ goto err_ret;
return 0;
-err_free_device:
- ieee802154_free_hw(priv->hw);
err_ret:
return ret;
}
@@ -1116,19 +1114,7 @@ static int cc2520_probe(struct spi_device *spi)
if (ret)
goto err_hw_init;
- /* Set up fifop interrupt */
- ret = devm_request_irq(&spi->dev,
- gpiod_to_irq(fifop),
- cc2520_fifop_isr,
- IRQF_TRIGGER_RISING,
- dev_name(&spi->dev),
- priv);
- if (ret) {
- dev_err(&spi->dev, "could not get fifop irq\n");
- goto err_hw_init;
- }
-
- /* Set up sfd interrupt */
+ /* SFD completes synchronous TX; install before cc2520_register(). */
ret = devm_request_irq(&spi->dev,
gpiod_to_irq(sfd),
cc2520_sfd_isr,
@@ -1142,13 +1128,29 @@ static int cc2520_probe(struct spi_device *spi)
ret = cc2520_register(priv);
if (ret)
- goto err_hw_init;
+ goto err_free_hw;
+
+ /* FIFOP arms the RX work; install after cc2520_register(). */
+ ret = devm_request_irq(&spi->dev,
+ gpiod_to_irq(fifop),
+ cc2520_fifop_isr,
+ IRQF_TRIGGER_RISING,
+ dev_name(&spi->dev),
+ priv);
+ if (ret) {
+ dev_err(&spi->dev, "could not get fifop irq\n");
+ goto err_unregister;
+ }
return 0;
+err_unregister:
+ ieee802154_unregister_hw(priv->hw);
+err_free_hw:
+ if (priv->hw)
+ ieee802154_free_hw(priv->hw);
err_hw_init:
mutex_destroy(&priv->buffer_mutex);
- flush_work(&priv->fifop_irqwork);
return ret;
}
@@ -1156,11 +1158,10 @@ static void cc2520_remove(struct spi_device *spi)
{
struct cc2520_private *priv = spi_get_drvdata(spi);
- mutex_destroy(&priv->buffer_mutex);
- flush_work(&priv->fifop_irqwork);
-
+ disable_work_sync(&priv->fifop_irqwork);
ieee802154_unregister_hw(priv->hw);
ieee802154_free_hw(priv->hw);
+ mutex_destroy(&priv->buffer_mutex);
}
static const struct spi_device_id cc2520_ids[] = {
