[PATCH] media: rc: ir-hix5hd2: set up device data before requesting the IRQ

[PATCH] media: rc: ir-hix5hd2: set up device data before requesting the IRQ

[David Yang]

The hix5hd2 IR interrupt handler passes priv->rdev to the
ir_raw_event_*() helpers, which dereference it immediately, and
devm_request_irq() unmasks the line as soon as it is called, so the
handler can run before probe() returns.

hix5hd2_ir_probe() has requested the IRQ before assigning priv->rdev
since the driver was introduced, so an interrupt already pending when
the line is requested, e.g. decoded symbols left by the boot firmware,
would pass a NULL rc_dev to ir_raw_event_store().

On Hi3716CV200 the handler ran 8 ms after the device was bound and took
a NULL-pointer fault in ir_raw_event_store() from interrupt context; on
Hi3798MV200H the same fault killed every boot 25 s into startup.

Request the IRQ only after the device data is set up.

The same ordering was fixed for talitos in commit 666d66df2525 ("crypto:
talitos - init tasklets before requesting IRQs") and for bgmac in commit
ac1f6e58cb77 ("net: bgmac: enable interrupts only after NAPI is ready").

Fixes: a84fcdaa9058 ("[media] rc: Introduce hix5hd2 IR transmitter driver")
Cc: stable@vger.kernel.org
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/media/rc/ir-hix5hd2.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index 1b061e4a3dcf..c3b984a0c2e4 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -316,6 +316,10 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
 	if (ret < 0)
 		goto clkerr;
 
+	priv->rdev = rdev;
+	priv->dev = dev;
+	platform_set_drvdata(pdev, priv);
+
 	if (devm_request_irq(dev, priv->irq, hix5hd2_ir_rx_interrupt,
 			     0, pdev->name, priv) < 0) {
 		dev_err(dev, "IRQ %d register failed\n", priv->irq);
@@ -323,10 +327,6 @@ static int hix5hd2_ir_probe(struct platform_device *pdev)
 		goto regerr;
 	}
 
-	priv->rdev = rdev;
-	priv->dev = dev;
-	platform_set_drvdata(pdev, priv);
-
 	return ret;
 
 regerr:
-- 
2.53.0