]> git.ipfire.org Git - thirdparty/linux.git/commit
spi: ti-qspi: fix use-after-free after DMA setup failure
authorJohan Hovold <johan@kernel.org>
Tue, 12 May 2026 07:48:09 +0000 (09:48 +0200)
committerMark Brown <broonie@kernel.org>
Mon, 18 May 2026 16:40:51 +0000 (17:40 +0100)
commitea6ec3343e05f7937a53eb6d7617b3abdb4abc19
tree6b39b6ee4778fb0ea178f428429e488f4f9c7eb0
parent3d67fffb74267772d461c02c67f1eff893ad547d
spi: ti-qspi: fix use-after-free after DMA setup failure

The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to clear the DMA channel pointer also if buffer allocation
fails to avoid passing a pointer to the released channel to the DMA
engine (or trying to free the channel a second time on late probe errors
or driver unbind).

This issue was flagged by Sashiko when reviewing a devres allocation
conversion patch.

Fixes: c687c46e9e45 ("spi: spi-ti-qspi: Use bounce buffer if read buffer is not DMA'ble")
Link: https://sashiko.dev/#/patchset/20260505072909.618363-1-johan%40kernel.org?part=17
Cc: stable@vger.kernel.org # 4.12
Cc: Vignesh R <vigneshr@ti.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260512074809.915084-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
drivers/spi/spi-ti-qspi.c