From: Felix Gu Date: Fri, 29 May 2026 15:31:06 +0000 (+0800) Subject: spi: ep93xx: fix double-free of zeropage on DMA setup failure X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7886054b06f762f62054957a8f6de0f14e6b7541;p=thirdparty%2Fkernel%2Flinux.git spi: ep93xx: fix double-free of zeropage on DMA setup failure If DMA setup fails after allocating the zeropage, the error path frees the page but leaves espi->zeropage dangling. A subsequent call to ep93xx_spi_release_dma() sees the non-NULL pointer and frees the page again. Clear the pointer after freeing in the error path of ep93xx_spi_setup_dma(). Fixes: 626a96db1169 ("spi/ep93xx: add DMA support") Signed-off-by: Felix Gu Link: https://patch.msgid.link/20260529-ep93xx-v1-1-9185070ca1fc@gmail.com Signed-off-by: Mark Brown --- diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c index ea610b0537a93..bf389d7590d35 100644 --- a/drivers/spi/spi-ep93xx.c +++ b/drivers/spi/spi-ep93xx.c @@ -600,6 +600,7 @@ fail_release_rx: espi->dma_rx = NULL; fail_free_page: free_page((unsigned long)espi->zeropage); + espi->zeropage = NULL; return ret; }