The FIFOP interrupt was requested before cc2520_register(), so a failed registration could still have let the FIFOP handler queue RX work. That work calls ieee802154_rx_irqsafe(), scheduling the mac802154 RX tasklet, which is killed only by ieee802154_unregister_hw(); on a failed registration that does not run, so ieee802154_free_hw() could free it while still pending. Request the FIFOP interrupt after cc2520_register() so a registration failure cannot schedule RX work, and the SFD interrupt before it, so synchronous TX has its completion available once the netdev is visible. cc2520_register() no longer frees the hardware on its own failure; the probe cleanup does. Found by an in-house static analysis tool. Fixes: 0da6bc8cc341 ("ieee802154: cc2520: adds driver for TI CC2520 radio") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu --- drivers/net/ieee802154/cc2520.c | 38 +++++++++++++++++---------------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c index abfcfe072..1b588f8d3 100644 --- a/drivers/net/ieee802154/cc2520.c +++ b/drivers/net/ieee802154/cc2520.c @@ -857,12 +857,10 @@ static int cc2520_register(struct cc2520_private *priv) dev_vdbg(&priv->spi->dev, "registered cc2520\n"); ret = ieee802154_register_hw(priv->hw); if (ret) - goto err_free_device; + goto err_ret; return 0; -err_free_device: - ieee802154_free_hw(priv->hw); err_ret: return ret; } @@ -1116,19 +1114,7 @@ static int cc2520_probe(struct spi_device *spi) if (ret) goto err_hw_init; - /* Set up fifop interrupt */ - ret = devm_request_irq(&spi->dev, - gpiod_to_irq(fifop), - cc2520_fifop_isr, - IRQF_TRIGGER_RISING, - dev_name(&spi->dev), - priv); - if (ret) { - dev_err(&spi->dev, "could not get fifop irq\n"); - goto err_hw_init; - } - - /* Set up sfd interrupt */ + /* SFD completes synchronous TX; install before cc2520_register(). */ ret = devm_request_irq(&spi->dev, gpiod_to_irq(sfd), cc2520_sfd_isr, @@ -1142,13 +1128,29 @@ static int cc2520_probe(struct spi_device *spi) ret = cc2520_register(priv); if (ret) - goto err_hw_init; + goto err_free_hw; + + /* FIFOP arms the RX work; install after cc2520_register(). */ + ret = devm_request_irq(&spi->dev, + gpiod_to_irq(fifop), + cc2520_fifop_isr, + IRQF_TRIGGER_RISING, + dev_name(&spi->dev), + priv); + if (ret) { + dev_err(&spi->dev, "could not get fifop irq\n"); + goto err_unregister; + } return 0; +err_unregister: + ieee802154_unregister_hw(priv->hw); +err_free_hw: + if (priv->hw) + ieee802154_free_hw(priv->hw); err_hw_init: mutex_destroy(&priv->buffer_mutex); - flush_work(&priv->fifop_irqwork); return ret; } -- 2.34.1