]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
spi: s3c64xx: fix NULL-deref on driver unbind
authorJohan Hovold <johan@kernel.org>
Fri, 10 Apr 2026 09:49:25 +0000 (11:49 +0200)
committerMark Brown <broonie@kernel.org>
Fri, 10 Apr 2026 12:45:39 +0000 (13:45 +0100)
A change moving DMA channel allocation from probe() back to
s3c64xx_spi_prepare_transfer() failed to remove the corresponding
deallocation from remove().

Drop the bogus DMA channel release from remove() to avoid triggering a
NULL-pointer dereference on driver unbind.

This issue was flagged by Sashiko when reviewing a controller
deregistration fix.

Fixes: f52b03c70744 ("spi: s3c64xx: requests spi-dma channel only during data transfer")
Cc: stable@vger.kernel.org # 6.0
Cc: Adithya K V <adithya.kv@samsung.com>
Link: https://sashiko.dev/#/patchset/20260410081757.503099-1-johan%40kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410094925.518343-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
drivers/spi/spi-s3c64xx.c

index 95b61264b67998b2f9943c86eb2ba157ea72a96a..37176e557099d1d86313fcdcac1abc1bebaa5db2 100644 (file)
@@ -1403,11 +1403,6 @@ static void s3c64xx_spi_remove(struct platform_device *pdev)
 
        writel(0, sdd->regs + S3C64XX_SPI_INT_EN);
 
-       if (!is_polling(sdd)) {
-               dma_release_channel(sdd->rx_dma.ch);
-               dma_release_channel(sdd->tx_dma.ch);
-       }
-
        pm_runtime_put_noidle(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
        pm_runtime_set_suspended(&pdev->dev);