soc: xilinx: Fix race condition in event registration

The zynqmp_power driver registers handlers for suspend and subsystem restart events using register_event(). However, the work structures (zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work) used by these handlers were allocated and initialized after the registration call.

This created a race window where, if the firmware triggered an event immediately after registration but before allocation, the callback (suspend_event_callback or subsystem_restart_event_callback) would dereference a NULL pointer in work_pending(), leading to a crash.

Fix this by allocating and initializing the work structures before registering the events.

Fixes fcf544ac6439 ("soc: xilinx: Add cb event for subsystem restart")

Signed-off-by Prasanna Kumar T S M <[email protected]>

---
  drivers/soc/xilinx/zynqmp_power.c | 43 ++++++++++++-------------------
  1 file changed, 17 insertions(+), 26 deletions(-)

drivers/soc/xilinx/zynqmp_power.c +17 -19

index 9085db1b480a..9dd938bd01d8 100644
@@ -303,18 +303,18 @@ static int zynqmp_pm_probe(struct platform_device *pdev)
  	 * is not available to use) or -ENODEV(Xilinx Event Manager not compiled),
  	 * then use ipi-mailbox or interrupt method.
  	 */
+	zynqmp_pm_init_suspend_work = devm_kzalloc(&pdev->dev,
+						   sizeof(struct zynqmp_pm_work_struct),
+						   GFP_KERNEL);
+	if (!zynqmp_pm_init_suspend_work)
+		return -ENOMEM;
+
+	INIT_WORK(&zynqmp_pm_init_suspend_work->callback_work,
+		  zynqmp_pm_init_suspend_work_fn);
+
  	ret = register_event(&pdev->dev, PM_INIT_SUSPEND_CB, 0, 0, false,
  			     suspend_event_callback);
  	if (!ret) {
-		zynqmp_pm_init_suspend_work = devm_kzalloc(&pdev->dev,
-							   sizeof(struct zynqmp_pm_work_struct),
-							   GFP_KERNEL);
-		if (!zynqmp_pm_init_suspend_work)
-			return -ENOMEM;
-
-		INIT_WORK(&zynqmp_pm_init_suspend_work->callback_work,
-			  zynqmp_pm_init_suspend_work_fn);
-
  		ret = zynqmp_pm_get_family_info(&pm_family_code);
  		if (ret < 0)
  			return ret;

@@ -326,14 +326,6 @@ static int zynqmp_pm_probe(struct platform_device *pdev)
  		else
  			return -ENODEV;
 
-		ret = register_event(&pdev->dev, PM_NOTIFY_CB, node_id, EVENT_SUBSYSTEM_RESTART,
-				     false, subsystem_restart_event_callback);
-		if (ret) {
-			dev_err(&pdev->dev, "Failed to Register with Xilinx Event manager %d\n",
-				ret);
-			return ret;
-		}
-
  		zynqmp_pm_init_restart_work = devm_kzalloc(&pdev->dev,
  							   sizeof(struct zynqmp_pm_work_struct),
  							   GFP_KERNEL);

@@ -342,19 +334,18 @@ static int zynqmp_pm_probe(struct platform_device *pdev)
 
  		INIT_WORK(&zynqmp_pm_init_restart_work->callback_work,
  			  zynqmp_pm_subsystem_restart_work_fn);
+
+		ret = register_event(&pdev->dev, PM_NOTIFY_CB, node_id, EVENT_SUBSYSTEM_RESTART,
+				     false, subsystem_restart_event_callback);
+		if (ret) {
+			dev_err(&pdev->dev, "Failed to Register with Xilinx Event manager %d\n",
+				ret);
+			return ret;
+		}
  	} else if (ret != -EACCES && ret != -ENODEV) {
  		dev_err(&pdev->dev, "Failed to Register with Xilinx Event manager %d\n", ret);
  		return ret;
  	} else if (of_property_present(pdev->dev.of_node, "mboxes")) {
-		zynqmp_pm_init_suspend_work =
-			devm_kzalloc(&pdev->dev,