diff options
| author | Nuno Sá <nuno.sa@analog.com> | 2026-04-24 20:40:14 +0300 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-06-08 15:07:06 +0300 |
| commit | 92f853f0645aebf1d05d333e97ab7c342ace1892 (patch) | |
| tree | b85ac4efd088445c7129018f3c0cebbb3a92c7ec /scripts/Makefile.thinlto | |
| parent | 8ffba0171c6bbce5f093c6dba5a02c0805b31203 (diff) | |
| download | linux-92f853f0645aebf1d05d333e97ab7c342ace1892.tar.xz | |
dmaengine: Fix possible use after free
In dma_release_channel(), check chan->device->privatecnt after call
dma_chan_put(). However, dma_chan_put() call dma_device_put() which could
release the last reference of the device if the DMA provider is already
gone and hence free it.
Fixes it by moving dma_chan_put() after the check.
Fixes: 0f571515c332 ("dmaengine: Add privatecnt to revert DMA_PRIVATE property")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260424-dma-dmac-handle-vunmap-v4-1-90f43412fdc0@analog.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions