trf7970a_probe() calls devm_request_threaded_irq() -- which registers the threaded handler trf7970a_irq() -- before it initializes trf->lock with mutex_init() and trf->timeout_work with INIT_DELAYED_WORK(). The handler takes trf->lock at entry and, through the helpers it dispatches to (fill_fifo/drain_fifo/issue_eof/transmit), can schedule_delayed_work() on trf->timeout_work. In the window between the IRQ request succeeding and those two initializations, an IRQ would therefore touch an uninitialized mutex and/or schedule an uninitialized delayed_work. Initialize trf->lock and trf->timeout_work before requesting the IRQ. On IRQ-request failure, destroy the mutex inline and return directly: the request failed, so no handler is registered and nothing else will touch the mutex. This issue was found by an in-house static analysis tool. Fixes: 165063f1dac4 ("NFC: trf7970a: Add driver with ISO/IEC 14443 Type 2 Tag Support") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu --- drivers/nfc/trf7970a.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c index f22e091..bc4d974 100644 --- a/drivers/nfc/trf7970a.c +++ b/drivers/nfc/trf7970a.c @@ -2124,18 +2124,19 @@ static int trf7970a_probe(struct spi_device *spi) } } + mutex_init(&trf->lock); + INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler); + ret = devm_request_threaded_irq(trf->dev, spi->irq, NULL, trf7970a_irq, IRQF_TRIGGER_RISING | IRQF_ONESHOT, "trf7970a", trf); if (ret) { dev_err(trf->dev, "Can't request IRQ#%d: %d\n", spi->irq, ret); + mutex_destroy(&trf->lock); return ret; } - mutex_init(&trf->lock); - INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler); - trf->vin_regulator = devm_regulator_get(&spi->dev, "vin"); if (IS_ERR(trf->vin_regulator)) { ret = PTR_ERR(trf->vin_regulator); -- 2.34.1