[PATCH] NFC: st21nfca: Release the I2C IRQ before freeing its resources

[Myeonghun Pak <mhun512@gmail.com>]

The threaded IRQ handler accesses pending_skb and passes received frames
through phy->hdev. During removal, st21nfca_hci_remove() frees the HCI
device and the LLC state, and pending_skb is also freed before devres
releases the IRQ. A pending or concurrent interrupt can therefore access
freed memory. The HCI probe failure path likewise frees pending_skb while
the IRQ is still registered.

Release the managed IRQ before removing the HCI device, waiting for the
threaded handler to finish. Also release it before freeing pending_skb
when HCI probing fails, while keeping earlier failures on the path that
has no registered IRQ to release.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 68957303f44a ("NFC: ST21NFCA: Add driver for STMicroelectronics ST21NFCA NFC Chip")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/nfc/st21nfca/i2c.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/st21nfca/i2c.c b/drivers/nfc/st21nfca/i2c.c
index a4c93ff7c5b0..894eb100ab5f 100644
--- a/drivers/nfc/st21nfca/i2c.c
+++ b/drivers/nfc/st21nfca/i2c.c
@@ -551,10 +551,12 @@ static int st21nfca_hci_i2c_probe(struct i2c_client *client)
 			       &phy->hdev,
 			       &phy->se_status);
 	if (r)
-		goto out_free;
+		goto out_free_irq;
 
 	return 0;
 
+out_free_irq:
+	devm_free_irq(&client->dev, client->irq, phy);
 out_free:
 	kfree_skb(phy->pending_skb);
 	return r;
@@ -564,6 +566,7 @@ static void st21nfca_hci_i2c_remove(struct i2c_client *client)
 {
 	struct st21nfca_i2c_phy *phy = i2c_get_clientdata(client);
 
+	devm_free_irq(&client->dev, client->irq, phy);
 	st21nfca_hci_remove(phy->hdev);
 
 	if (phy->powered)
-- 
2.47.1