Commit 5b280051 authored by Wadim Egorov's avatar Wadim Egorov Committed by Tong Tiangen
Browse files

usb: typec: tipd: Free IRQ only if it was requested before

stable inclusion
from stable-v6.6.57
commit b72bf5cade51ba4055c8a8998d275e72e6b521ce
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRI8
CVE: CVE-2024-50057

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b72bf5cade51ba4055c8a8998d275e72e6b521ce



--------------------------------

[ Upstream commit db63d9868f7f310de44ba7bea584e2454f8b4ed0 ]

In polling mode, if no IRQ was requested there is no need to free it.
Call devm_free_irq() only if client->irq is set. This fixes the warning
caused by the tps6598x module removal:

WARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devm_free_irq+0x80/0x8c
...
...
Call trace:
  devm_free_irq+0x80/0x8c
  tps6598x_remove+0x28/0x88 [tps6598x]
  i2c_device_remove+0x2c/0x9c
  device_remove+0x4c/0x80
  device_release_driver_internal+0x1cc/0x228
  driver_detach+0x50/0x98
  bus_remove_driver+0x6c/0xbc
  driver_unregister+0x30/0x60
  i2c_del_driver+0x54/0x64
  tps6598x_i2c_driver_exit+0x18/0xc3c [tps6598x]
  __arm64_sys_delete_module+0x184/0x264
  invoke_syscall+0x48/0x110
  el0_svc_common.constprop.0+0xc8/0xe8
  do_el0_svc+0x20/0x2c
  el0_svc+0x28/0x98
  el0t_64_sync_handler+0x13c/0x158
  el0t_64_sync+0x190/0x194

Signed-off-by: default avatarWadim Egorov <w.egorov@phytec.de>
Reviewed-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240816124150.608125-1-w.egorov@phytec.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarTong Tiangen <tongtiangen@huawei.com>
parent a42fc9da
Loading
Loading
Loading
Loading
+2 −0
Original line number Diff line number Diff line
@@ -907,6 +907,8 @@ static void tps6598x_remove(struct i2c_client *client)

	if (!client->irq)
		cancel_delayed_work_sync(&tps->wq_poll);
	else
		devm_free_irq(tps->dev, client->irq, tps);

	tps6598x_disconnect(tps, 0);
	typec_unregister_port(tps->port);