[PATCH] rtc: mpc5121: request IRQs after allocating the RTC device

[Rosen Penev <rosenp@gmail.com>]

Probe requests both IRQs with devm_request_irq() before
devm_rtc_allocate_device(). Devres releases resources in reverse order,
so on unbind or probe failure the RTC device is put before the IRQs
are freed. A handler running in that window passes the stale rtc->rtc
to rtc_update_irq(), which schedules work on the freed device.

On unbind, remove() first disables the alarm and update interrupts, so
only a handler already running on another CPU is affected. On a probe
failure after the IRQs are requested, remove() does not run, and an
alarm left pending, for example a wake alarm from before a reboot, can
fire in that window.

Request the IRQs after the RTC device is allocated and set up, right
before registering it, so devres frees them and waits for running
handlers before releasing the device. An interrupt arriving before
registration is harmless, as rtc_update_irq() only schedules work on
an allocated device.

Fixes: d53d4ae981d0 ("rtc: mpc5121: simplify probe")
Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/rtc/rtc-mpc5121.c | 48 ++++++++++++++++++++-------------------
 1 file changed, 25 insertions(+), 23 deletions(-)

diff --git a/drivers/rtc/rtc-mpc5121.c b/drivers/rtc/rtc-mpc5121.c
index b90f8337a7e6..4a03c5280a24 100644
--- a/drivers/rtc/rtc-mpc5121.c
+++ b/drivers/rtc/rtc-mpc5121.c
@@ -307,30 +307,9 @@ static int mpc5121_rtc_probe(struct platform_device *op)
 
 	platform_set_drvdata(op, rtc);
 
-	rtc->irq = irq_of_parse_and_map(op->dev.of_node, 1);
-	err = devm_request_irq(&op->dev, rtc->irq, mpc5121_rtc_handler, 0,
-			       "mpc5121-rtc", &op->dev);
-	if (err) {
-		dev_err(&op->dev, "%s: could not request irq: %i\n",
-							__func__, rtc->irq);
-		goto out_dispose;
-	}
-
-	rtc->irq_periodic = irq_of_parse_and_map(op->dev.of_node, 0);
-	err = devm_request_irq(&op->dev, rtc->irq_periodic,
-			       mpc5121_rtc_handler_upd, 0, "mpc5121-rtc_upd",
-			       &op->dev);
-	if (err) {
-		dev_err(&op->dev, "%s: could not request irq: %i\n",
-						__func__, rtc->irq_periodic);
-		goto out_dispose2;
-	}
-
 	rtc->rtc = devm_rtc_allocate_device(&op->dev);
-	if (IS_ERR(rtc->rtc)) {
-		err = PTR_ERR(rtc->rtc);
-		goto out_dispose2;
-	}
+	if (IS_ERR(rtc->rtc))
+		return PTR_ERR(rtc->rtc);
 
 	rtc->rtc->ops = &mpc5200_rtc_ops;
 	set_bit(RTC_FEATURE_ALARM_RES_MINUTE, rtc->rtc->features);
@@ -356,6 +335,29 @@ static int mpc5121_rtc_probe(struct platform_device *op)
 		rtc->rtc->range_max = U32_MAX;
 	}
 
+	/*
+	 * Request the IRQs after allocating the RTC device, so devres frees
+	 * them, and waits for running handlers, before releasing it.
+	 */
+	rtc->irq = irq_of_parse_and_map(op->dev.of_node, 1);
+	err = devm_request_irq(&op->dev, rtc->irq, mpc5121_rtc_handler, 0,
+			       "mpc5121-rtc", &op->dev);
+	if (err) {
+		dev_err(&op->dev, "%s: could not request irq: %i\n",
+							__func__, rtc->irq);
+		goto out_dispose;
+	}
+
+	rtc->irq_periodic = irq_of_parse_and_map(op->dev.of_node, 0);
+	err = devm_request_irq(&op->dev, rtc->irq_periodic,
+			       mpc5121_rtc_handler_upd, 0, "mpc5121-rtc_upd",
+			       &op->dev);
+	if (err) {
+		dev_err(&op->dev, "%s: could not request irq: %i\n",
+						__func__, rtc->irq_periodic);
+		goto out_dispose2;
+	}
+
 	err = devm_rtc_register_device(rtc->rtc);
 	if (err)
 		goto out_dispose2;
-- 
2.56.0