[PATCH] drm/bridge: adv7511: cancel HPD work during teardown

[Hongyan Xu]

The threaded IRQ handler queues hpd_work. The work accesses the regmap
and calls drm_bridge_hpd_notify(), so it must not run after the bridge or
the devm-allocated driver data has been released.

Free the IRQ before cancelling hpd_work so the handler cannot queue the
work again. Do this in remove and when adv7533_attach_dsi() fails after
the IRQ has been registered.

The remove-side race was reported previously, but the proposed fix did
not cover the late probe failure path.

This issue was found by a static analysis tool.

Fixes: 518cb7057a59 ("drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context")
Reported-by: Zheng Wang <zyytlz.wz@xxxxxxx>
Link: https://lore.kernel.org/r/20230413065943.198088-1-zyytlz.wz@xxxxxxx
Signed-off-by: Hongyan Xu <getshell@xxxxxxxxxx>
---
 drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index 02f8f7e78..132ec4793 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -1400,11 +1400,15 @@ static int adv7511_probe(struct i2c_client *i2c)
 	if (adv7511->info->has_dsi) {
 		ret = adv7533_attach_dsi(adv7511);
 		if (ret)
-			goto err_unregister_audio;
+			goto err_free_irq;
 	}
 
 	return 0;
 
+err_free_irq:
+	if (i2c->irq)
+		devm_free_irq(dev, i2c->irq, adv7511);
+	cancel_work_sync(&adv7511->hpd_work);
 err_unregister_audio:
 	drm_bridge_remove(&adv7511->bridge);
 	i2c_unregister_device(adv7511->i2c_cec);
@@ -1425,6 +1429,10 @@ static void adv7511_remove(struct i2c_client *i2c)
 {
 	struct adv7511 *adv7511 = i2c_get_clientdata(i2c);
 
+	if (i2c->irq)
+		devm_free_irq(&i2c->dev, i2c->irq, adv7511);
+	cancel_work_sync(&adv7511->hpd_work);
+
 	of_node_put(adv7511->host_node);
 
 	adv7511_uninit_regulators(adv7511);
-- 
2.50.1.windows.1