[PATCH] nfc: nxp-nci: fix IRQ use-after-free in i2c remove

[PATCH] nfc: nxp-nci: fix IRQ use-after-free in i2c remove

[Aldo Ariel Panzardo]

nxp_nci_i2c_remove() calls nxp_nci_remove() before free_irq().
nxp_nci_remove() unregisters the NCI device and frees ndev via
nci_free_device().  The IRQ handler nxp_nci_i2c_irq_thread_fn()
dereferences phy->ndev and calls nci_get_drvdata() on it; if the
interrupt fires between the nxp_nci_remove() and free_irq() calls the
handler operates on freed memory.

Swap the order: disable the interrupt first with free_irq(), then tear
down the device.

Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 drivers/nfc/nxp-nci/i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
index XXXXXXX..YYYYYYY 100644
--- a/drivers/nfc/nxp-nci/i2c.c
+++ b/drivers/nfc/nxp-nci/i2c.c
@@ -346,8 +346,8 @@ static void nxp_nci_i2c_remove(struct i2c_client *client)
 {
 	struct nxp_nci_i2c_phy *phy = i2c_get_clientdata(client);

-	nxp_nci_remove(phy->ndev);
 	free_irq(client->irq, phy);
+	nxp_nci_remove(phy->ndev);
 }

 static const struct i2c_device_id nxp_nci_i2c_id_table[] = {

Re: [PATCH] nfc: nxp-nci: fix IRQ use-after-free in i2c remove

[Simon Horman]

On Fri, Sep 25, 2026 at 02:58:00PM -0300, Aldo Ariel Panzardo wrote:
> nxp_nci_i2c_remove() calls nxp_nci_remove() before free_irq().
> nxp_nci_remove() unregisters the NCI device and frees ndev via
> nci_free_device().  The IRQ handler nxp_nci_i2c_irq_thread_fn()
> dereferences phy->ndev and calls nci_get_drvdata() on it; if the
> interrupt fires between the nxp_nci_remove() and free_irq() calls the
> handler operates on freed memory.
> 
> Swap the order: disable the interrupt first with free_irq(), then tear
> down the device.
> 
> Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>