diff options
| author | Johan Hovold <johan@kernel.org> | 2026-04-14 16:43:19 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2026-04-20 14:39:31 +0300 |
| commit | 9d72732fe70c11424bc90ed466c7ccfa58b42a9a (patch) | |
| tree | 78f001d3968a1a5fc0ce68a3bd2da218c6010953 | |
| parent | 5d6f477d6fc0767c57c5e1e6f55a1662820eef87 (diff) | |
| download | linux-9d72732fe70c11424bc90ed466c7ccfa58b42a9a.tar.xz | |
spi: topcliff-pch: fix use-after-free on unbind
Give the driver a chance to flush its queue before releasing the DMA
buffers on driver unbind
Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support")
Cc: stable@vger.kernel.org # 3.1
Cc: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
| -rw-r--r-- | drivers/spi/spi-topcliff-pch.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c index c120436434d0..14d11450e86d 100644 --- a/drivers/spi/spi-topcliff-pch.c +++ b/drivers/spi/spi-topcliff-pch.c @@ -1410,9 +1410,6 @@ static void pch_spi_pd_remove(struct platform_device *plat_dev) spi_unregister_controller(data->host); - if (use_dma) - pch_free_dma_buf(board_dat, data); - /* check for any pending messages; no action is taken if the queue * is still full; but at least we tried. Unload anyway */ count = 500; @@ -1436,6 +1433,9 @@ static void pch_spi_pd_remove(struct platform_device *plat_dev) free_irq(board_dat->pdev->irq, data); } + if (use_dma) + pch_free_dma_buf(board_dat, data); + pci_iounmap(board_dat->pdev, data->io_remap_addr); spi_controller_put(data->host); |