From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2991C4338F for ; Thu, 19 Aug 2021 15:49:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BC05D610D2 for ; Thu, 19 Aug 2021 15:49:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240583AbhHSPuT (ORCPT ); Thu, 19 Aug 2021 11:50:19 -0400 Received: from mail.ispras.ru ([83.149.199.84]:47272 "EHLO mail.ispras.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238776AbhHSPuS (ORCPT ); Thu, 19 Aug 2021 11:50:18 -0400 Received: from kleverstation.intra.ispras.ru (unknown [10.10.2.220]) by mail.ispras.ru (Postfix) with ESMTPS id 0E9424076273; Thu, 19 Aug 2021 15:49:41 +0000 (UTC) From: Nadezda Lutovinova To: Michael Tretter Cc: Nadezda Lutovinova , Pengutronix Kernel Team , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: [PATCH] media: allegro: request irq after initializing mbox_status Date: Thu, 19 Aug 2021 18:49:35 +0300 Message-Id: <20210819154935.19826-1-lutovinova@ispras.ru> X-Mailer: git-send-email 2.17.1 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org If IRQ occurs between calling devm_request_threaded_irq() and allegro_firmware_request_nowait(), then null pointer dereference occurs since dev->mbox_status wasn't initialized yet but used in allegro_mbox_notify(). The patch puts registration of the interrupt handler after initializing of neccesery data. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Nadezda Lutovinova --- .../media/platform/allegro-dvt/allegro-core.c | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/drivers/media/platform/allegro-dvt/allegro-core.c b/drivers/media/platform/allegro-dvt/allegro-core.c index 887b492e4ad1..9c1997ff74e8 100644 --- a/drivers/media/platform/allegro-dvt/allegro-core.c +++ b/drivers/media/platform/allegro-dvt/allegro-core.c @@ -3707,18 +3707,6 @@ static int allegro_probe(struct platform_device *pdev) return PTR_ERR(dev->sram); } - irq = platform_get_irq(pdev, 0); - if (irq < 0) - return irq; - ret = devm_request_threaded_irq(&pdev->dev, irq, - allegro_hardirq, - allegro_irq_thread, - IRQF_SHARED, dev_name(&pdev->dev), dev); - if (ret < 0) { - dev_err(&pdev->dev, "failed to request irq: %d\n", ret); - return ret; - } - ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev); if (ret) return ret; @@ -3732,6 +3720,18 @@ static int allegro_probe(struct platform_device *pdev) return ret; } + irq = platform_get_irq(pdev, 0); + if (irq < 0) + return irq; + ret = devm_request_threaded_irq(&pdev->dev, irq, + allegro_hardirq, + allegro_irq_thread, + IRQF_SHARED, dev_name(&pdev->dev), dev); + if (ret < 0) { + dev_err(&pdev->dev, "failed to request irq: %d\n", ret); + return ret; + } + return 0; } -- 2.17.1