net: wan: hd64572: KASAN null-ptr-deref in sca_intr() on early IRQ

[Jaeyoung Chung]

Hi,

The interrupt handler sca_intr() in drivers/net/wan/hd64572.c is
registered by both pc300too and pci200syn before they initialize
port->card. If an interrupt arrives before port->card is initialized,
sca_intr() dereferences a NULL port->card, causing a kernel panic.

The probe path, in pc300too.c (pc300_pci_init_one()):

    request_irq(pdev->irq, sca_intr, IRQF_SHARED, "pc300", card); /* register handler */
    ...
    port->card = card;                                            /* initialize port->card */

pci200syn.c (pci200_pci_init_one()) has the same ordering:

    request_irq(pdev->irq, sca_intr, IRQF_SHARED, "pci200syn", card); /* register handler */
    ...
    port->card = card;                                               /* initialize port->card */

The handler sca_intr() in hd64572.c dereferences port->card through
disable_intr().

If the device raises an interrupt before port->card is initialized, the
handler dereferences the NULL port->card, triggering a KASAN
null-ptr-deref.

Suggested fix: assign port->card before request_irq() in both probes, so
the pointer is valid before the handler can run.

Reported-by: Sangyun Kim <sangyun.kim@xxxxxxxxx>
Reported-by: Kyungwook Boo <bookyungwook@xxxxxxxxx>

Thanks,
Jaeyoung Chung