spi: ep93xx: fix double-free of zeropage on DMA setup failure

If DMA setup fails after allocating the zeropage, the error path frees
the page but leaves espi->zeropage dangling. A subsequent call to
ep93xx_spi_release_dma() sees the non-NULL pointer and frees the page
again.

Clear the pointer after freeing in the error path of
ep93xx_spi_setup_dma().

Fixes: 626a96db1169 ("spi/ep93xx: add DMA support")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260529-ep93xx-v1-1-9185070ca1fc@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
index ea610b0537a938e3a1246ecbfb48a4ce2a377b44..bf389d7590d35e0e259d05620be2fc8278ae96be 100644 (file)
--- a/drivers/spi/spi-ep93xx.c
+++ b/drivers/spi/spi-ep93xx.c
@@ -600,6 +600,7 @@ fail_release_rx:
        espi->dma_rx = NULL;
 fail_free_page:
        free_page((unsigned long)espi->zeropage);
+       espi->zeropage = NULL;
 
        return ret;
 }