[PATCH net v3 0/2] nfc: trf7970a: fix lifetime ordering around IRQ setup and teardown

[PATCH net v3 0/2] nfc: trf7970a: fix lifetime ordering around IRQ setup and teardown

[Fan Wu]

Two lifetime-ordering fixes for the trf7970a NFC digital driver.

Patch 1 sets up the lock and timeout work before the threaded IRQ is
registered, and moves the lock to devm_mutex_init() so its teardown is
part of the devres lifetime.

Patch 2 depends on patch 1 and drains the timeout work across removal:
it marks a running handler to skip completion, handles LISTENING_MD in
shutdown, and cancels the work after the digital core stops issuing
commands and before the digital device is freed.

These were previously sent as standalone patches. Per review feedback
from Simon Horman they are respun as a series.

---

v3:
  - Respun as a 2-patch series with an explicit dependency.
  - Patch 1: switch to devm_mutex_init(); remove the explicit
    mutex_destroy() calls and the now-empty err_destroy_lock label.
  - Patch 2: set ignore_timeout before send_err_upstream; handle
    TRF7970A_ST_LISTENING_MD in shutdown.
  - Patch 1 was previously sent standalone.

init-order v1: https://lore.kernel.org/netdev/20260728031021.230831-1-fanwu01@zju.edu.cn/
teardown v2:   https://lore.kernel.org/netdev/20260728030716.230626-1-fanwu01@zju.edu.cn/
teardown v1:   https://lore.kernel.org/netdev/20260721133539.3195899-1-fanwu01@zju.edu.cn/


Fan Wu (2):
  nfc: trf7970a: set up lock and timeout work before requesting IRQ
  nfc: trf7970a: quiesce timeout work before teardown

 drivers/nfc/trf7970a.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

-- 
2.34.1

[PATCH net v3 1/2] nfc: trf7970a: set up lock and timeout work before requesting IRQ

[Fan Wu]

trf7970a_probe() registers the threaded IRQ handler before it
initialises the lock the handler takes on entry and the delayed work it
can queue. An interrupt arriving in that window can use either object
before it has been initialised.

Set up both before registering the IRQ, and use devm_mutex_init() for
the lock. This makes the mutex teardown part of the devres lifetime: the
IRQ is released before the mutex is destroyed, and both precede freeing
trf. It also retains CONFIG_DEBUG_MUTEXES lifetime checking.

The explicit mutex_destroy() calls and the now-empty err_destroy_lock
label are removed.

This issue was found by an in-house static analysis tool.

Fixes: 165063f1dac4 ("NFC: trf7970a: Add driver with ISO/IEC 14443 Type 2 Tag Support")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/nfc/trf7970a.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c
index f22e091..9c6f8db 100644
--- a/drivers/nfc/trf7970a.c
+++ b/drivers/nfc/trf7970a.c
@@ -2124,6 +2124,12 @@ static int trf7970a_probe(struct spi_device *spi)
 		}
 	}
 
+	ret = devm_mutex_init(trf->dev, &trf->lock);
+	if (ret)
+		return ret;
+
+	INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler);
+
 	ret = devm_request_threaded_irq(trf->dev, spi->irq, NULL,
 					trf7970a_irq,
 					IRQF_TRIGGER_RISING | IRQF_ONESHOT,
@@ -2133,20 +2139,17 @@ static int trf7970a_probe(struct spi_device *spi)
 		return ret;
 	}
 
-	mutex_init(&trf->lock);
-	INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler);
-
 	trf->vin_regulator = devm_regulator_get(&spi->dev, "vin");
 	if (IS_ERR(trf->vin_regulator)) {
 		ret = PTR_ERR(trf->vin_regulator);
 		dev_err(trf->dev, "Can't get VIN regulator: %d\n", ret);
-		goto err_destroy_lock;
+		return ret;
 	}
 
 	ret = regulator_enable(trf->vin_regulator);
 	if (ret) {
 		dev_err(trf->dev, "Can't enable VIN: %d\n", ret);
-		goto err_destroy_lock;
+		return ret;
 	}
 
 	uvolts = regulator_get_voltage(trf->vin_regulator);
@@ -2212,8 +2215,6 @@ err_disable_vddio_regulator:
 	regulator_disable(trf->vddio_regulator);
 err_disable_vin_regulator:
 	regulator_disable(trf->vin_regulator);
-err_destroy_lock:
-	mutex_destroy(&trf->lock);
 	return ret;
 }
 
@@ -2232,8 +2233,6 @@ static void trf7970a_remove(struct spi_device *spi)
 
 	regulator_disable(trf->vddio_regulator);
 	regulator_disable(trf->vin_regulator);
-
-	mutex_destroy(&trf->lock);
 }
 
 #ifdef CONFIG_PM_SLEEP
-- 
2.34.1

[PATCH net v3 2/2] nfc: trf7970a: quiesce timeout work before teardown

[Fan Wu]

The timeout work can be running, blocked on trf->lock, while
trf7970a_remove() runs trf7970a_shutdown() under that lock. shutdown()
completes the active command through trf->cb(), but its non-blocking
cancel cannot stop a handler that is already running. Once remove drops
the lock, the handler may resume and complete the same command a second
time through trf->cb(). By then nfc_digital_unregister_device() may have
freed the struct digital_cmd referenced by trf->cb_arg.

Set ignore_timeout before shutdown completes the command, so the handler
short-circuits when it resumes. Then call cancel_delayed_work_sync()
after nfc_digital_unregister_device() and before nfc_digital_free_device().

Handle TRF7970A_ST_LISTENING_MD in shutdown so RF is switched off for
that state too; otherwise a threaded IRQ can re-arm the work after the
drain.

This patch depends on the preceding patch, which keeps trf->lock valid
until the threaded IRQ is drained.

This issue was found by an in-house static analysis tool.

Fixes: 165063f1dac4 ("NFC: trf7970a: Add driver with ISO/IEC 14443 Type 2 Tag Support")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/nfc/trf7970a.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c
index 9c6f8db..42e7c05 100644
--- a/drivers/nfc/trf7970a.c
+++ b/drivers/nfc/trf7970a.c
@@ -2015,6 +2015,8 @@ static void trf7970a_shutdown(struct trf7970a *trf)
 	case TRF7970A_ST_WAIT_FOR_RX_DATA_CONT:
 	case TRF7970A_ST_WAIT_TO_ISSUE_EOF:
 	case TRF7970A_ST_LISTENING:
+	case TRF7970A_ST_LISTENING_MD:
+		trf->ignore_timeout = true;
 		trf7970a_send_err_upstream(trf, -ECANCELED);
 		fallthrough;
 	case TRF7970A_ST_IDLE:
@@ -2210,6 +2212,7 @@ static int trf7970a_probe(struct spi_device *spi)
 err_shutdown:
 	trf7970a_shutdown(trf);
 err_free_ddev:
+	cancel_delayed_work_sync(&trf->timeout_work);
 	nfc_digital_free_device(trf->ddev);
 err_disable_vddio_regulator:
 	regulator_disable(trf->vddio_regulator);
@@ -2229,6 +2232,7 @@ static void trf7970a_remove(struct spi_device *spi)
 	mutex_unlock(&trf->lock);
 
 	nfc_digital_unregister_device(trf->ddev);
+	cancel_delayed_work_sync(&trf->timeout_work);
 	nfc_digital_free_device(trf->ddev);
 
 	regulator_disable(trf->vddio_regulator);
-- 
2.34.1

Re: [PATCH net v3 0/2] nfc: trf7970a: fix lifetime ordering around IRQ setup and teardown

[Simon Horman]

On Sat, Aug 01, 2026 at 05:10:56AM +0000, Fan Wu wrote:
> Two lifetime-ordering fixes for the trf7970a NFC digital driver.
> 
> Patch 1 sets up the lock and timeout work before the threaded IRQ is
> registered, and moves the lock to devm_mutex_init() so its teardown is
> part of the devres lifetime.
> 
> Patch 2 depends on patch 1 and drains the timeout work across removal:
> it marks a running handler to skip completion, handles LISTENING_MD in
> shutdown, and cancels the work after the digital core stops issuing
> commands and before the digital device is freed.
> 
> These were previously sent as standalone patches. Per review feedback
> from Simon Horman they are respun as a series.
> 
> ---
> 
> v3:
>   - Respun as a 2-patch series with an explicit dependency.
>   - Patch 1: switch to devm_mutex_init(); remove the explicit
>     mutex_destroy() calls and the now-empty err_destroy_lock label.
>   - Patch 2: set ignore_timeout before send_err_upstream; handle
>     TRF7970A_ST_LISTENING_MD in shutdown.
>   - Patch 1 was previously sent standalone.
> 
> init-order v1: https://lore.kernel.org/netdev/20260728031021.230831-1-fanwu01@zju.edu.cn/
> teardown v2:   https://lore.kernel.org/netdev/20260728030716.230626-1-fanwu01@zju.edu.cn/
> teardown v1:   https://lore.kernel.org/netdev/20260721133539.3195899-1-fanwu01@zju.edu.cn/

For the series:

Reviewed-by: Simon Horman <horms@kernel.org>