[PATCH 4/6] backlight: qcom-wled: Manage teardown via devres and remove wled_remove()

[Lee Jones <lee@kernel.org>]

wled_remove() currently runs before devres tears down the backlight
device and threaded interrupts, resulting in two teardown bugs:

1. mutex_destroy(&wled->lock) and cancel_delayed_work_sync(&wled->ovp_work)
   execute while the backlight device registered via
   devm_backlight_device_register() and the short interrupt requested
   via devm_request_threaded_irq() are still active.  A concurrent sysfs
   brightness update or short interrupt during unbind can acquire the
   destroyed mutex and re-schedule wled->ovp_work before devres frees
   the wled structure.

2. disable_irq(wled->short_irq) and disable_irq(wled->ovp_irq) are
   called unconditionally even when the optional "short" or "ovp"
   interrupts are absent from the Device Tree (-ENXIO) or unused (0 on
   WLED3), passing invalid IRQ numbers to disable_irq(), despite both
   interrupts already being managed by devm_request_threaded_irq().

Initialise wled->lock with devm_mutex_init() and remove wled_remove()
so that devres tears down the backlight device, short interrupt,
delayed work, OVP interrupt, mutex, and driver data in reverse
registration order.

Fixes: feeab87b3072 ("backlight: qcom-wled: Add support for short circuit handling")
Fixes: 8663c188beea ("backlight: qcom-wled: Add auto string detection logic")
Closes: https://sashiko.dev/#/bug/linux-51cd5e35-3cae-4e4c-986b-7261263507cd
Closes: https://sashiko.dev/#/bug/linux-44e5ed80-c35c-4786-8bf8-9ee955967d0b
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
Cc: David Heidelberg <david@ixit.cz>
Cc: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

 drivers/video/backlight/qcom-wled.c | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/drivers/video/backlight/qcom-wled.c b/drivers/video/backlight/qcom-wled.c
index f8f41e1d6ccf..8d4d7fe5e84d 100644
--- a/drivers/video/backlight/qcom-wled.c
+++ b/drivers/video/backlight/qcom-wled.c
@@ -1732,7 +1732,6 @@ static int wled_probe(struct platform_device *pdev)
 
 	wled->regmap = regmap;
 	wled->dev = &pdev->dev;
-	platform_set_drvdata(pdev, wled);
 
 	wled->version = (uintptr_t)of_device_get_match_data(&pdev->dev);
 	if (!wled->version) {
@@ -1740,7 +1739,10 @@ static int wled_probe(struct platform_device *pdev)
 		return -ENODEV;
 	}
 
-	mutex_init(&wled->lock);
+	rc = devm_mutex_init(&pdev->dev, &wled->lock);
+	if (rc)
+		return rc;
+
 	rc = wled_configure(wled);
 	if (rc)
 		return rc;
@@ -1822,16 +1824,6 @@ static int wled_probe(struct platform_device *pdev)
 	return PTR_ERR_OR_ZERO(bl);
 };
 
-static void wled_remove(struct platform_device *pdev)
-{
-	struct wled *wled = platform_get_drvdata(pdev);
-
-	mutex_destroy(&wled->lock);
-	cancel_delayed_work_sync(&wled->ovp_work);
-	disable_irq(wled->short_irq);
-	disable_irq(wled->ovp_irq);
-}
-
 static const struct of_device_id wled_match_table[] = {
 	{ .compatible = "qcom,pm8941-wled", .data = (void *)3 },
 	{ .compatible = "qcom,pmi8950-wled", .data = (void *)4 },
@@ -1846,7 +1838,6 @@ MODULE_DEVICE_TABLE(of, wled_match_table);
 
 static struct platform_driver wled_driver = {
 	.probe = wled_probe,
-	.remove = wled_remove,
 	.driver	= {
 		.name = "qcom,wled",
 		.of_match_table	= wled_match_table,
-- 
2.56.0.385.gac671c819a-goog