[PATCH] nfc: microread: stop the I2C IRQ before removing the HCI device

[Myeonghun Pak <mhun512@gmail.com>]

Removal frees the HCI device before the I2C IRQ, allowing a running or
new handler to pass a frame to a freed context. Probe also enables the
IRQ before microread_probe() initializes phy->hdev.

Keep the IRQ disabled until HCI setup succeeds, and free it before HCI
removal. Failed probe can then release the IRQ without callbacks into an
uninitialized HCI context.

This issue was found by static analysis.

Fixes: 71054c7db161 ("NFC: microread: Add i2c physical layer")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/nfc/microread/i2c.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/nfc/microread/i2c.c b/drivers/nfc/microread/i2c.c
index f45e883b8730..07da86db989f 100644
--- a/drivers/nfc/microread/i2c.c
+++ b/drivers/nfc/microread/i2c.c
@@ -244,7 +244,7 @@ static int microread_i2c_probe(struct i2c_client *client)
 	phy->i2c_dev = client;
 
 	r = request_threaded_irq(client->irq, NULL, microread_i2c_irq_thread_fn,
-				 IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+				 IRQF_TRIGGER_RISING | IRQF_ONESHOT | IRQF_NO_AUTOEN,
 				 MICROREAD_I2C_DRIVER_NAME, phy);
 	if (r) {
 		nfc_err(&client->dev, "Unable to register IRQ handler\n");
@@ -258,6 +258,8 @@ static int microread_i2c_probe(struct i2c_client *client)
 	if (r < 0)
 		goto err_irq;
 
+	enable_irq(client->irq);
+
 	return 0;
 
 err_irq:
@@ -270,9 +272,8 @@ static void microread_i2c_remove(struct i2c_client *client)
 {
 	struct microread_i2c_phy *phy = i2c_get_clientdata(client);
 
-	microread_remove(phy->hdev);
-
 	free_irq(client->irq, phy);
+	microread_remove(phy->hdev);
 }
 
 static const struct i2c_device_id microread_i2c_id[] = {