From 13f2d32a09609d083ace2d589fbdc68e970ae34c Mon Sep 17 00:00:00 2001 From: Hongling Zeng Date: Mon, 27 Jul 2026 14:17:05 +0800 Subject: dmaengine: at_hdmac: Fix use-after-free by proper tasklet cleanup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Current cleanup paths have a use-after-free vulnerability: - vchan_init() creates tasklets that access at_dma_chan memory - free_irq() only waits for IRQ handler, NOT tasklets - atdma is devm-managed and freed after probe/remove - Running tasklets accessing freed memory → Use-After-Free! The fix requires careful ordering: - free_irq() FIRST to synchronize with running IRQ handlers and prevent them from scheduling new tasklets - Then kill tasklets to wait for already-scheduled ones to complete - Only then free other resources Fixes: ac803b56860f ("dmaengine: at_hdmac: Convert driver to use virt-dma") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260604073945.54B311F00898@smtp.kernel.org/ Signed-off-by: Hongling Zeng Suggested-by: Frank Li Reviewed-by: Frank Li Link: https://patch.msgid.link/20260727061705.45169-1-zenghongling@kylinos.cn Signed-off-by: Vinod Koul --- drivers/dma/at_hdmac.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c index 7c071e649637..7fa6af973fd8 100644 --- a/drivers/dma/at_hdmac.c +++ b/drivers/dma/at_hdmac.c @@ -1940,6 +1940,20 @@ static void at_dma_off(struct at_dma *atdma) cpu_relax(); } +static void at_dma_cleanup_channels(struct at_dma *atdma) +{ + struct dma_chan *chan, *_chan; + int i = 0; + + list_for_each_entry_safe(chan, _chan, &atdma->dma_device.channels, + device_node) { + /* Disable interrupts */ + atc_disable_chan_irq(atdma, i++); + tasklet_kill(&to_at_dma_chan(chan)->vc.task); + list_del(&chan->device_node); + } +} + static int __init at_dma_probe(struct platform_device *pdev) { struct at_dma *atdma; @@ -2105,6 +2119,8 @@ static int __init at_dma_probe(struct platform_device *pdev) err_of_dma_controller_register: dma_async_device_unregister(&atdma->dma_device); err_dma_async_device_register: + disable_irq(platform_get_irq(pdev, 0)); + at_dma_cleanup_channels(atdma); dma_pool_destroy(atdma->memset_pool); err_memset_pool_create: dma_pool_destroy(atdma->lli_pool); @@ -2118,23 +2134,17 @@ err_irq: static void at_dma_remove(struct platform_device *pdev) { struct at_dma *atdma = platform_get_drvdata(pdev); - struct dma_chan *chan, *_chan; at_dma_off(atdma); if (pdev->dev.of_node) of_dma_controller_free(pdev->dev.of_node); dma_async_device_unregister(&atdma->dma_device); - dma_pool_destroy(atdma->memset_pool); - dma_pool_destroy(atdma->lli_pool); free_irq(platform_get_irq(pdev, 0), atdma); - list_for_each_entry_safe(chan, _chan, &atdma->dma_device.channels, - device_node) { - /* Disable interrupts */ - atc_disable_chan_irq(atdma, chan->chan_id); - list_del(&chan->device_node); - } + at_dma_cleanup_channels(atdma); + dma_pool_destroy(atdma->memset_pool); + dma_pool_destroy(atdma->lli_pool); clk_disable_unprepare(atdma->clk); } -- cgit v1.2.3