tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

spi: topcliff-pch: fix use-after-free on unbind

Give the driver a chance to flush its queue before releasing the DMA
buffers on driver unbind

Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support")
Cc: stable@vger.kernel.org # 3.1
Cc: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>

authored by

Johan Hovold and committed by
Mark Brown 9d72732f 5d6f477d

+3 -3
+3 -3
drivers/spi/spi-topcliff-pch.c
··· 1410 1410 1411 1411 spi_unregister_controller(data->host); 1412 1412 1413 - if (use_dma) 1414 - pch_free_dma_buf(board_dat, data); 1415 - 1416 1413 /* check for any pending messages; no action is taken if the queue 1417 1414 * is still full; but at least we tried. Unload anyway */ 1418 1415 count = 500; ··· 1432 1435 data->irq_reg_sts = false; 1433 1436 free_irq(board_dat->pdev->irq, data); 1434 1437 } 1438 + 1439 + if (use_dma) 1440 + pch_free_dma_buf(board_dat, data); 1435 1441 1436 1442 pci_iounmap(board_dat->pdev, data->io_remap_addr); 1437 1443