From: Hans de Goede Date: Mon, 23 Jun 2025 08:50:47 +0000 (+0200) Subject: mei: vsc: Destroy mutex after freeing the IRQ X-Git-Tag: v6.12.42~332 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4a958702b7cc3d30bb374950624f455592bb13f6;p=thirdparty%2Fkernel%2Fstable.git mei: vsc: Destroy mutex after freeing the IRQ [ Upstream commit 35b7f3525fe0a7283de7116e3c75ee3ccb3b14c9 ] The event_notify callback which runs from vsc_tp_thread_isr may call vsc_tp_xfer() which locks the mutex. So the ISR depends on the mutex. Move the mutex_destroy() call to after free_irq() to ensure that the ISR is not running while the mutex is destroyed. Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-6-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- diff --git a/drivers/misc/mei/vsc-tp.c b/drivers/misc/mei/vsc-tp.c index 5e44b518f36c7..f8e622caec348 100644 --- a/drivers/misc/mei/vsc-tp.c +++ b/drivers/misc/mei/vsc-tp.c @@ -554,10 +554,10 @@ static int vsc_tp_probe(struct spi_device *spi) return 0; err_destroy_lock: - mutex_destroy(&tp->mutex); - free_irq(spi->irq, tp); + mutex_destroy(&tp->mutex); + return ret; } @@ -567,9 +567,9 @@ static void vsc_tp_remove(struct spi_device *spi) platform_device_unregister(tp->pdev); - mutex_destroy(&tp->mutex); - free_irq(spi->irq, tp); + + mutex_destroy(&tp->mutex); } static void vsc_tp_shutdown(struct spi_device *spi)