The FIFOP interrupt was requested before cc2520_register(), so a failed
registration could still have let the FIFOP handler queue RX work. That
work calls ieee802154_rx_irqsafe(), scheduling the mac802154 RX tasklet,
which is killed only by ieee802154_unregister_hw(); on a failed
registration that does not run, so ieee802154_free_hw() could free it
while still pending.
Request the FIFOP interrupt after cc2520_register() so a registration
failure cannot schedule RX work, and the SFD interrupt before it, so
synchronous TX has its completion available once the netdev is visible.
cc2520_register() no longer frees the hardware on its own failure; the
probe cleanup does.
Found by an in-house static analysis tool.
Fixes: 0da6bc8cc341 ("ieee802154: cc2520: adds driver for TI CC2520 radio")
Cc: [email protected]
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <[email protected]>
---
drivers/net/ieee802154/cc2520.c | 38 +++++++++++++++++----------------
1 file changed, 20 insertions(+), 18 deletions(-)
diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
index abfcfe072..1b588f8d3 100644
--- a/drivers/net/ieee802154/cc2520.c
+++ b/drivers/net/ieee802154/cc2520.c
@@ -857,12 +857,10 @@ static int cc2520_register(struct cc2520_private *priv)
dev_vdbg(&priv->spi->dev, "registered cc2520\n");
ret = ieee802154_register_hw(priv->hw);
if (ret)
- goto err_free_device;
+ goto err_ret;
return 0;
-err_free_device:
- ieee802154_free_hw(priv->hw);
err_ret:
return ret;
}
@@ -1116,19 +1114,7 @@ static int cc2520_probe(struct spi_device *spi)
if (ret)
goto err_hw_init;
- /* Set up fifop interrupt */
- ret = devm_request_irq(&spi->dev,
- gpiod_to_irq(fifop),
- cc2520_fifop_isr,
- IRQF_TRIGGER_RISING,
- dev_name(&spi->dev),
- priv);
- if (ret) {
- dev_err(&spi->dev, "could not get fifop irq\n");
- goto err_hw_init;
- }
-
- /* Set up sfd interrupt */
+ /* SFD completes synchronous TX; install before cc2520_register(). */
ret = devm_request_irq(&spi->dev,
gpiod_to_irq(sfd),
cc2520_sfd_isr,
@@ -1142,13 +1128,29 @@ static int cc2520_probe(struct spi_device *spi)
ret = cc2520_register(priv);
if (ret)
- goto err_hw_init;
+ goto err_free_hw;
+
+ /* FIFOP arms the RX work; install after cc2520_register(). */
+ ret = devm_request_irq(&spi->dev,
+ gpiod_to_irq(fifop),
+ cc2520_fifop_isr,
+ IRQF_TRIGGER_RISING,
+ dev_name(&spi->dev),
+ priv);
+ if (ret) {
+ dev_err(&spi->dev, "could not get fifop irq\n");
+ goto err_unregister;
+ }
return 0;
+err_unregister:
+ ieee802154_unregister_hw(priv->hw);
+err_free_hw:
+ if (priv->hw)
+ ieee802154_free_hw(priv->hw);
err_hw_init:
mutex_destroy(&priv->buffer_mutex);
- flush_work(&priv->fifop_irqwork);
return ret;
}
--
2.34.1
