[PATCH 02/11] ASoC: SOF: amd: fix amd_sof_acp_remove() teardown ordering

[Vijendar Mukunda]

Call free_irq() before amd_sof_sdw_exit() in amd_sof_acp_remove().
amd_sof_sdw_exit() sets adata->sdw to NULL; if an IRQ fires between
that point and the subsequent free_irq(), acp_irq_handler() may
dereference the now-NULL pdev[] pointer, causing a use-after-free.

Fixes: d948218424bf ("ASoC: SOF: amd: add code for invoking soundwire manager helper functions")
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@xxxxxxx>
---
 sound/soc/sof/amd/acp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c
index 688df7acd2e2..e4cdb74c075d 100644
--- a/sound/soc/sof/amd/acp.c
+++ b/sound/soc/sof/amd/acp.c
@@ -1048,12 +1048,12 @@ void amd_sof_acp_remove(struct snd_sof_dev *sdev)
 {
 	struct acp_dev_data *adata = sdev->pdata->hw_pdata;
 
-	if (adata->sdw)
-		amd_sof_sdw_exit(sdev);
-
 	if (sdev->ipc_irq)
 		free_irq(sdev->ipc_irq, sdev);
 
+	if (adata->sdw)
+		amd_sof_sdw_exit(sdev);
+
 	if (adata->dmic_dev)
 		platform_device_unregister(adata->dmic_dev);
 
-- 
2.48.1