[PATCH 1/2] media: cadence: csi2rx: free error IRQ before private state

[PATCH 1/2] media: cadence: csi2rx: free error IRQ before private state

[Myeonghun Pak]

The managed error IRQ is released after private state is freed on remove
and post-request probe failures, allowing use-after-free in the handler.

Free the IRQ before releasing private state on these paths.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 9f2d0da9b8c3 ("media: cadence: csi2rx: Enable csi2rx_err_irq interrupt and add support for VIDIOC_LOG_STATUS")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/media/platform/cadence/cdns-csi2rx.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c
index de7cce76397ab03b3dcdc4b5e68d2d92dca183ea..f8c626e19aa84569737aa785a31a0f8c94087613 100644
--- a/drivers/media/platform/cadence/cdns-csi2rx.c
+++ b/drivers/media/platform/cadence/cdns-csi2rx.c
@@ -993,7 +993,7 @@ static int csi2rx_probe(struct platform_device *pdev)
 
 	ret = v4l2_subdev_init_finalize(&csi2rx->subdev);
 	if (ret)
-		goto err_cleanup;
+		goto err_free_irq;
 
 	pm_runtime_enable(csi2rx->dev);
 	ret = v4l2_async_register_subdev(&csi2rx->subdev);
@@ -1011,6 +1011,9 @@ static int csi2rx_probe(struct platform_device *pdev)
 err_free_state:
 	v4l2_subdev_cleanup(&csi2rx->subdev);
 	pm_runtime_disable(csi2rx->dev);
+err_free_irq:
+	if (csi2rx->error_irq >= 0)
+		devm_free_irq(csi2rx->dev, csi2rx->error_irq, csi2rx);
 err_cleanup:
 	v4l2_async_nf_unregister(&csi2rx->notifier);
 	v4l2_async_nf_cleanup(&csi2rx->notifier);
@@ -1030,6 +1033,8 @@ static void csi2rx_remove(struct platform_device *pdev)
 	v4l2_subdev_cleanup(&csi2rx->subdev);
 	media_entity_cleanup(&csi2rx->subdev.entity);
 	pm_runtime_disable(csi2rx->dev);
+	if (csi2rx->error_irq >= 0)
+		devm_free_irq(csi2rx->dev, csi2rx->error_irq, csi2rx);
 	kfree(csi2rx);
 }
 

[PATCH 2/2] media: cadence: csi2rx: disable error IRQ while runtime suspended

[Myeonghun Pak]

The error IRQ handler accesses MMIO while runtime suspend can disable
its clocks without draining the handler.

Request the IRQ with IRQF_NO_AUTOEN, enable it after successful runtime
resume, and disable and drain it before runtime suspend gates clocks.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: c85d3d5362a8 ("media: cadence: csi2rx: Support runtime PM")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/media/platform/cadence/cdns-csi2rx.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c
index f8c626e19aa84569737aa785a31a0f8c94087613..9bb776b5a4c8248a65df733e3a8963a6393f0996 100644
--- a/drivers/media/platform/cadence/cdns-csi2rx.c
+++ b/drivers/media/platform/cadence/cdns-csi2rx.c
@@ -982,7 +982,7 @@ static int csi2rx_probe(struct platform_device *pdev)
 		dev_dbg(csi2rx->dev, "Optional interrupt not defined, proceeding without it\n");
 	} else {
 		ret = devm_request_irq(csi2rx->dev, csi2rx->error_irq,
-				       csi2rx_irq_handler, 0,
+				       csi2rx_irq_handler, IRQF_NO_AUTOEN,
 				       dev_name(&pdev->dev), csi2rx);
 		if (ret) {
 			dev_err(csi2rx->dev,
@@ -1042,6 +1042,10 @@ static int csi2rx_runtime_suspend(struct device *dev)
 {
 	struct csi2rx_priv *csi2rx = dev_get_drvdata(dev);
 
+	/* Drain the handler before disabling the clocks it needs. */
+	if (csi2rx->error_irq >= 0)
+		disable_irq(csi2rx->error_irq);
+
 	reset_control_assert(csi2rx->sys_rst);
 	clk_disable_unprepare(csi2rx->sys_clk);
 
@@ -1082,6 +1086,9 @@ static int csi2rx_runtime_resume(struct device *dev)
 
 	reset_control_deassert(csi2rx->sys_rst);
 
+	if (csi2rx->error_irq >= 0)
+		enable_irq(csi2rx->error_irq);
+
 	return 0;
 
 err_disable_pixclk: