[PATCH] media: ir-hix5hd2: Disable the interrupt before freeing the rc device

[PATCH] media: ir-hix5hd2: Disable the interrupt before freeing the rc device

[Myeonghun Pak]

The devm-managed IRQ remains active while hix5hd2_ir_remove() disables
the clock and frees the rc device. The receiver may still be running
after open() or resume(), allowing the handler to access unclocked
registers or pass a freed rc device to the raw event code.

Call disable_irq() first to stop and synchronize the handler before
clock shutdown and rc device teardown. This must also precede
rc_unregister_device(), whose close callback can disable the clock or
reset the hardware.

Found by a static analysis tool under development.
Not tested on hardware.

Fixes: a84fcdaa9058 ("[media] rc: Introduce hix5hd2 IR transmitter driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---

 drivers/media/rc/ir-hix5hd2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index f74deb408218..e6770588399b 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -344,6 +344,7 @@ static void hix5hd2_ir_remove(struct platform_device *pdev)
 {
 	struct hix5hd2_ir_priv *priv = platform_get_drvdata(pdev);
 
+	disable_irq(priv->irq);
 	clk_disable_unprepare(priv->clock);
 	rc_unregister_device(priv->rdev);
 	rc_free_device(priv->rdev);

base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
-- 
2.43.0