[PATCH] dmaengine: mmp_pdma: kill tasklet on channel teardown

[hyunjungg <hj351016@gmail.com>]

From: Hyunjung Ko <hj351016@gmail.com>

The per-channel completion tasklet (dma_do_tasklet) is scheduled from the
channel interrupt handler but is never torn down.  mmp_pdma_remove() frees
the interrupts and unregisters the DMA device, but the channel objects --
and with them the tasklet_struct -- are devm-allocated and are therefore
freed only after .remove() returns.  A tasklet scheduled just before the
interrupt was freed can still be pending at that point, so it runs against
freed memory (use-after-free).

Kill each channel's tasklet after the interrupts have been freed (so none
can be re-scheduled) and before the DMA device is unregistered, mirroring
the teardown fixes applied to other dmaengine drivers.

Fixes: c8acd6aa6bed ("dmaengine: mmp-pdma support")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/dma/mmp_pdma.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c
index 8abd24e..2f0de65 100644
--- a/drivers/dma/mmp_pdma.c
+++ b/drivers/dma/mmp_pdma.c
@@ -1119,6 +1119,7 @@ static void mmp_pdma_remove(struct platform_device *op)
 {
 	struct mmp_pdma_device *pdev = platform_get_drvdata(op);
 	struct mmp_pdma_phy *phy;
+	struct dma_chan *chan;
 	int i, irq = 0, irq_num = 0;
 
 	if (op->dev.of_node)
@@ -1140,6 +1141,14 @@ static void mmp_pdma_remove(struct platform_device *op)
 		}
 	}
 
+	/*
+	 * The interrupts are gone now, so no new work can be scheduled.
+	 * Kill any tasklet that is still pending before the channels are
+	 * freed, otherwise it would run against freed memory.
+	 */
+	list_for_each_entry(chan, &pdev->device.channels, device_node)
+		tasklet_kill(&to_mmp_pdma_chan(chan)->tasklet);
+
 	dma_async_device_unregister(&pdev->device);
 }
 
-- 
2.43.0