[PATCH v7 08/10] mfd: nct6694: Submit the interrupt URB after the core is registered

From: Ming Yu <[email protected]>

The interrupt URB is submitted before nct6694_core_probe() creates the
IRQ domain. A device completing the URB early makes the callback pass a
NULL domain to irq_find_mapping(), which then falls back to the default
domain and dispatches interrupts the device does not own.

Submit the URB once the core is registered, and kill it before the core
is removed so the callback never runs without a domain.

Fixes: 51dad33ede63 ("mfd: Add core driver for Nuvoton NCT6694")
Signed-off-by: Ming Yu <[email protected]>
---
Changes in v7:
- New patch. Fixes the URB-before-IRQ-domain race reported on v6
  patch 6/7.

 drivers/mfd/nct6694-usb.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/mfd/nct6694-usb.c b/drivers/mfd/nct6694-usb.c
index c8667984df5e..cc3e7b7b3a0d 100644
--- a/drivers/mfd/nct6694-usb.c
+++ b/drivers/mfd/nct6694-usb.c
@@ -312,20 +312,20 @@ static int nct6694_usb_probe(struct usb_interface *iface,
 			 udata->int_buffer, sizeof(*udata->int_buffer), nct6694_usb_int_callback,
 			 nct6694, int_endpoint->bInterval);
 
-	ret = usb_submit_urb(udata->int_in_urb, GFP_KERNEL);
-	if (ret)
-		goto err_urb;
-
 	usb_set_intfdata(iface, nct6694);
 
 	ret = nct6694_core_probe(dev, nct6694, nct6694_usb_devs, ARRAY_SIZE(nct6694_usb_devs));
 	if (ret)
-		goto err_mfd;
+		goto err_urb;
+
+	ret = usb_submit_urb(udata->int_in_urb, GFP_KERNEL);
+	if (ret)
+		goto err_core;
 
 	return 0;
 
-err_mfd:
-	usb_kill_urb(udata->int_in_urb);
+err_core:
+	nct6694_core_remove(nct6694);
 err_urb:
 	usb_free_urb(udata->int_in_urb);
 	return ret;
@@ -336,8 +336,8 @@ static void nct6694_usb_disconnect(struct usb_interface *iface)
 	struct nct6694 *nct6694 = usb_get_intfdata(iface);
 	struct nct6694_usb_data *udata = nct6694->priv;
 
-	nct6694_core_remove(nct6694);
 	usb_kill_urb(udata->int_in_urb);
+	nct6694_core_remove(nct6694);
 	usb_free_urb(udata->int_in_urb);
 }
 
-- 
2.34.1