venus_probe() calls hfi_create() before requesting the IRQ, but the IRQ request failure path does not call hfi_destroy(). The history patch moved hfi_create() before the IRQ request to ensure that the interrupt handler context is initialized before an interrupt can be delivered. However, if devm_request_threaded_irq() fails after hfi_create() succeeds, the error path jumps directly to err_core_put and leaves the HFI resources allocated. Request the IRQ with IRQF_NO_AUTOEN before creating the HFI device so that the interrupt remains disabled during HFI initialization. Enable the IRQ only after hfi_create() succeeds. This preserves the protection against interrupts arriving before HFI initialization while ensuring that an IRQ request failure cannot leak HFI resources. This issue was found by manual code inspection. Fixes: 3200144a2fa4 ("media: venus: protect against spurious interrupts during probe") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/media/platform/qcom/venus/core.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c index 243e342b0ae7..42348bdc2332 100644 --- a/drivers/media/platform/qcom/venus/core.c +++ b/drivers/media/platform/qcom/venus/core.c @@ -432,16 +432,19 @@ static int venus_probe(struct platform_device *pdev) INIT_DELAYED_WORK(&core->work, venus_sys_error_handler); init_waitqueue_head(&core->sys_err_done); - ret = hfi_create(core, &venus_core_ops); + ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, + venus_isr_thread, + IRQF_TRIGGER_HIGH | IRQF_ONESHOT | + IRQF_NO_AUTOEN, "venus", core); if (ret) goto err_core_put; - ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, - IRQF_TRIGGER_HIGH | IRQF_ONESHOT, - "venus", core); + ret = hfi_create(core, &venus_core_ops); if (ret) goto err_core_put; + enable_irq(core->irq); + venus_assign_register_offsets(core); ret = v4l2_device_register(dev, &core->v4l2_dev); -- 2.43.0