[PATCH] usb: renesas_usbhs: free IRQ before probe failure cleanup

[Guangshuo Li]

usbhs_mod_probe() registers the interrupt handler with devm_request_irq().
If a later step in usbhs_probe() fails, the driver tears down the module,
FIFO and pipe state before returning from probe.

The devm-managed IRQ is only released after usbhs_probe() returns, so the
interrupt handler is still live while the manual probe failure cleanup is
running. If an interrupt arrives after the pipe state has been removed but
before devres releases the IRQ, the ISR can access freed resources.

Free and synchronize the IRQ before tearing down the resources used by
the interrupt handler, matching the ordering used by the remove path.

Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code")
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/usb/renesas_usbhs/common.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index 8c93bde4b816..047f9f90c874 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -786,6 +786,7 @@ static int usbhs_probe(struct platform_device *pdev)
 probe_assert_rest:
 	reset_control_assert(priv->rsts);
 probe_fail_rst:
+	devm_free_irq(&pdev->dev, priv->irq, priv);
 	usbhs_mod_remove(priv);
 probe_end_fifo_exit:
 	usbhs_fifo_remove(priv);
-- 
2.43.0