diff options
| author | Logan Gunthorpe <logang@deltatee.com> | 2026-09-02 00:21:49 -0600 |
|---|---|---|
| committer | Vinod Koul <vkoul@kernel.org> | 2026-10-05 15:44:12 +0200 |
| commit | 9f744689c49defa61238836829202d1473da2ea5 (patch) | |
| tree | 1d597cdb2a313b7ba3c1994ad16bfe2bce811be2 /tools/lib/python/kdoc | |
| parent | 5b4c561554b2f802a4e3db539ba2c586b72b7721 (diff) | |
dmaengine: switchtec-dma: fix use-after-free of swdma_dev in remove()
dma_async_device_unregister() can drop the last reference on dma_dev
and free swdma_dev synchronously via switchtec_dma_release(), but
switchtec_dma_remove() then uses swdma_dev->bar for iounmap().
Cache bar in a local variable before the unregister call.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
Link: https://patch.msgid.link/20260902062153.31048-8-logang@deltatee.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc')
0 files changed, 0 insertions, 0 deletions