mei: vsc: Destroy mutex after freeing the IRQ

[ Upstream commit 35b7f3525fe0a7283de7116e3c75ee3ccb3b14c9 ]

The event_notify callback which runs from vsc_tp_thread_isr may call
vsc_tp_xfer() which locks the mutex. So the ISR depends on the mutex.

Move the mutex_destroy() call to after free_irq() to ensure that the ISR
is not running while the mutex is destroyed.

Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device")
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://lore.kernel.org/r/20250623085052.12347-6-hansg@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/misc/mei/vsc-tp.c b/drivers/misc/mei/vsc-tp.c
index 267d0de5fade83f85ef229691cf0c100924c9927..66b41b86ea7da91a61b82ba33efeaff82ad851a2 100644 (file)
--- a/drivers/misc/mei/vsc-tp.c
+++ b/drivers/misc/mei/vsc-tp.c
@@ -552,10 +552,10 @@ static int vsc_tp_probe(struct spi_device *spi)
        return 0;
 
 err_destroy_lock:
-       mutex_destroy(&tp->mutex);
-
        free_irq(spi->irq, tp);
 
+       mutex_destroy(&tp->mutex);
+
        return ret;
 }
 
@@ -565,9 +565,9 @@ static void vsc_tp_remove(struct spi_device *spi)
 
        platform_device_unregister(tp->pdev);
 
-       mutex_destroy(&tp->mutex);
-
        free_irq(spi->irq, tp);
+
+       mutex_destroy(&tp->mutex);
 }
 
 static void vsc_tp_shutdown(struct spi_device *spi)