ASoC: cs42l42: free_irq() before powering-down on probe() fail

Relying on devm to free the irq handler on probe failure leaves a
small window of opportunity for an interrupt to become pending and
then the handler to run after the chip has been reset and powered
off.

For safety cs42l42_probe() should free the irq in the error path.
As the irq is now disabled by the driver in probe() and remove()
there is no point allocating it as a devres-managed item, so
convert to plain non-devres.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20211026125722.10220-3-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index dc12842ee6e1ee2fd119ceb8e6f6ed08d7bbcdf6..1029f6b3eb485f2ea1f46eec8f879c6308e41388 100644 (file)
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -2078,17 +2078,16 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
 
        /* Request IRQ if one was specified */
        if (i2c_client->irq) {
-               ret = devm_request_threaded_irq(&i2c_client->dev,
-                                               i2c_client->irq,
-                                               NULL, cs42l42_irq_thread,
-                                               IRQF_ONESHOT | IRQF_TRIGGER_LOW,
-                                               "cs42l42", cs42l42);
+               ret = request_threaded_irq(i2c_client->irq,
+                                          NULL, cs42l42_irq_thread,
+                                          IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+                                          "cs42l42", cs42l42);
                if (ret == -EPROBE_DEFER) {
-                       goto err_disable;
+                       goto err_disable_noirq;
                } else if (ret != 0) {
                        dev_err(&i2c_client->dev,
                                "Failed to request IRQ: %d\n", ret);
-                       goto err_disable;
+                       goto err_disable_noirq;
                }
        }
 
@@ -2158,6 +2157,10 @@ err_shutdown:
        regmap_write(cs42l42->regmap, CS42L42_PWR_CTL1, 0xff);
 
 err_disable:
+       if (i2c_client->irq)
+               free_irq(i2c_client->irq, cs42l42);
+
+err_disable_noirq:
        gpiod_set_value_cansleep(cs42l42->reset_gpio, 0);
 err_disable_noreset:
        regulator_bulk_disable(ARRAY_SIZE(cs42l42->supplies),
@@ -2170,7 +2173,7 @@ static int cs42l42_i2c_remove(struct i2c_client *i2c_client)
        struct cs42l42_private *cs42l42 = i2c_get_clientdata(i2c_client);
 
        if (i2c_client->irq)
-               devm_free_irq(&i2c_client->dev, i2c_client->irq, cs42l42);
+               free_irq(i2c_client->irq, cs42l42);
 
        /*
         * The driver might not have control of reset and power supplies,