Hi, Following up on this tasklet teardown fix sent September 23.
Is there any additional testing or any change needed for review? I'm happy to work on it. Please let me know if another reviewer would be better placed to look at this driver. Thanks, Aldo On Wed, 23 Sep 2026 10:53:01 -0300, Aldo Ariel Panzardo <[email protected]> wrote: > fsl_dma_chan_remove() frees the fsldma_chan structure without first > quiescing the channel's tasklet. If an IRQ fires just before the > remove and schedules the tasklet, dma_do_tasklet() runs against the > freed channel struct, causing a use-after-free. > > Add tasklet_kill() before tearing the channel down. > > Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling") > Cc: [email protected] > Reported-by: Sashiko <[email protected]> > Signed-off-by: Aldo Ariel Panzardo <[email protected]> > --- > drivers/dma/fsldma.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c > index 22d62d9..0e2f848 100644 > --- a/drivers/dma/fsldma.c > +++ b/drivers/dma/fsldma.c > @@ -1205,6 +1205,7 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev, > > static void fsl_dma_chan_remove(struct fsldma_chan *chan) > { > + tasklet_kill(&chan->tasklet); > irq_dispose_mapping(chan->irq); > list_del(&chan->common.device_node); > iounmap(chan->regs); > -- > 2.43.0
