Re: [PATCH] nfc: nxp-nci: fix IRQ use-after-free in i2c remove

[Simon Horman]

On Fri, Sep 25, 2026 at 02:58:00PM -0300, Aldo Ariel Panzardo wrote:
> nxp_nci_i2c_remove() calls nxp_nci_remove() before free_irq().
> nxp_nci_remove() unregisters the NCI device and frees ndev via
> nci_free_device().  The IRQ handler nxp_nci_i2c_irq_thread_fn()
> dereferences phy->ndev and calls nci_get_drvdata() on it; if the
> interrupt fires between the nxp_nci_remove() and free_irq() calls the
> handler operates on freed memory.
> 
> Swap the order: disable the interrupt first with free_irq(), then tear
> down the device.
> 
> Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@xxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>