* [PATCH] dmaengine: fsldma: kill the channel tasklet on remove
@ 2026-09-23 13:53 Aldo Ariel Panzardo
0 siblings, 0 replies; 2+ messages in thread
From: Aldo Ariel Panzardo @ 2026-09-23 13:53 UTC (permalink / raw)
To: vkoul
Cc: linuxppc-dev, dmaengine, linux-kernel, stable,
Aldo Ariel Panzardo, Sashiko
fsl_dma_chan_remove() frees the fsldma_chan structure without first
quiescing the channel's tasklet. If an IRQ fires just before the
remove and schedules the tasklet, dma_do_tasklet() runs against the
freed channel struct, causing a use-after-free.
Add tasklet_kill() before tearing the channel down.
Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
drivers/dma/fsldma.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 22d62d9..0e2f848 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1205,6 +1205,7 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev,
static void fsl_dma_chan_remove(struct fsldma_chan *chan)
{
+ tasklet_kill(&chan->tasklet);
irq_dispose_mapping(chan->irq);
list_del(&chan->common.device_node);
iounmap(chan->regs);
--
2.43.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH] dmaengine: fsldma: kill the channel tasklet on remove
@ 2026-09-23 13:50 Aldo Ariel Panzardo
0 siblings, 0 replies; 2+ messages in thread
From: Aldo Ariel Panzardo @ 2026-09-23 13:50 UTC (permalink / raw)
To: zw
Cc: linuxppc-dev, dmaengine, linux-kernel, stable,
Aldo Ariel Panzardo, Sashiko
fsl_dma_chan_remove() frees the fsldma_chan structure without first
quiescing the channel's tasklet. If an IRQ fires just before the
remove and schedules the tasklet, dma_do_tasklet() runs against the
freed channel struct, causing a use-after-free.
Add tasklet_kill() before tearing the channel down.
Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
drivers/dma/fsldma.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 22d62d9..0e2f848 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1205,6 +1205,7 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev,
static void fsl_dma_chan_remove(struct fsldma_chan *chan)
{
+ tasklet_kill(&chan->tasklet);
irq_dispose_mapping(chan->irq);
list_del(&chan->common.device_node);
iounmap(chan->regs);
--
2.43.0
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-23 13:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-23 13:53 [PATCH] dmaengine: fsldma: kill the channel tasklet on remove Aldo Ariel Panzardo
-- strict thread matches above, loose matches on Subject: below --
2026-09-23 13:50 Aldo Ariel Panzardo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®