[PATCH net] nfc: trf7970a: initialize lock and timeout_work before requesting the IRQ

[Fan Wu]

trf7970a_probe() calls devm_request_threaded_irq() -- which registers the
threaded handler trf7970a_irq() -- before it initializes trf->lock with
mutex_init() and trf->timeout_work with INIT_DELAYED_WORK(). The handler
takes trf->lock at entry and, through the helpers it dispatches to
(fill_fifo/drain_fifo/issue_eof/transmit), can schedule_delayed_work() on
trf->timeout_work. In the window between the IRQ request succeeding and
those two initializations, an IRQ would therefore touch an uninitialized
mutex and/or schedule an uninitialized delayed_work.

Initialize trf->lock and trf->timeout_work before requesting the IRQ. On
IRQ-request failure, destroy the mutex inline and return directly: the
request failed, so no handler is registered and nothing else will touch
the mutex.

This issue was found by an in-house static analysis tool.

Fixes: 165063f1dac4 ("NFC: trf7970a: Add driver with ISO/IEC 14443 Type 2 Tag Support")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>
---
 drivers/nfc/trf7970a.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c
index f22e091..bc4d974 100644
--- a/drivers/nfc/trf7970a.c
+++ b/drivers/nfc/trf7970a.c
@@ -2124,18 +2124,19 @@ static int trf7970a_probe(struct spi_device *spi)
 		}
 	}
 
+	mutex_init(&trf->lock);
+	INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler);
+
 	ret = devm_request_threaded_irq(trf->dev, spi->irq, NULL,
 					trf7970a_irq,
 					IRQF_TRIGGER_RISING | IRQF_ONESHOT,
 					"trf7970a", trf);
 	if (ret) {
 		dev_err(trf->dev, "Can't request IRQ#%d: %d\n", spi->irq, ret);
+		mutex_destroy(&trf->lock);
 		return ret;
 	}
 
-	mutex_init(&trf->lock);
-	INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler);
-
 	trf->vin_regulator = devm_regulator_get(&spi->dev, "vin");
 	if (IS_ERR(trf->vin_regulator)) {
 		ret = PTR_ERR(trf->vin_regulator);
-- 
2.34.1