[PATCH] media: venus: avoid HFI resource leak on IRQ request failure

[Guangshuo Li]

venus_probe() calls hfi_create() before requesting the IRQ, but the IRQ
request failure path does not call hfi_destroy().

The history patch moved hfi_create() before the IRQ request to ensure
that the interrupt handler context is initialized before an interrupt
can be delivered. However, if devm_request_threaded_irq() fails after
hfi_create() succeeds, the error path jumps directly to err_core_put
and leaves the HFI resources allocated.

Request the IRQ with IRQF_NO_AUTOEN before creating the HFI device so
that the interrupt remains disabled during HFI initialization. Enable
the IRQ only after hfi_create() succeeds.

This preserves the protection against interrupts arriving before HFI
initialization while ensuring that an IRQ request failure cannot leak
HFI resources.

This issue was found by manual code inspection.

Fixes: 3200144a2fa4 ("media: venus: protect against spurious interrupts during probe")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/media/platform/qcom/venus/core.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
index 243e342b0ae7..42348bdc2332 100644
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -432,16 +432,19 @@ static int venus_probe(struct platform_device *pdev)
 	INIT_DELAYED_WORK(&core->work, venus_sys_error_handler);
 	init_waitqueue_head(&core->sys_err_done);
 
-	ret = hfi_create(core, &venus_core_ops);
+	ret = devm_request_threaded_irq(dev, core->irq, hfi_isr,
+					venus_isr_thread,
+					IRQF_TRIGGER_HIGH | IRQF_ONESHOT |
+					IRQF_NO_AUTOEN, "venus", core);
 	if (ret)
 		goto err_core_put;
 
-	ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread,
-					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
-					"venus", core);
+	ret = hfi_create(core, &venus_core_ops);
 	if (ret)
 		goto err_core_put;
 
+		enable_irq(core->irq);
+
 	venus_assign_register_offsets(core);
 
 	ret = v4l2_device_register(dev, &core->v4l2_dev);
-- 
2.43.0