spi: topcliff-pch: fix use-after-free on unbind

Give the driver a chance to flush its queue before releasing the DMA
buffers on driver unbind

Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support")
Cc: stable@vger.kernel.org	# 3.1
Cc: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index c120436434d0e6945400245c6ce3fe439c3301b9..14d11450e86dc6b225b989190a651a52643f41c9 100644 (file)
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -1410,9 +1410,6 @@ static void pch_spi_pd_remove(struct platform_device *plat_dev)
 
        spi_unregister_controller(data->host);
 
-       if (use_dma)
-               pch_free_dma_buf(board_dat, data);
-
        /* check for any pending messages; no action is taken if the queue
         * is still full; but at least we tried.  Unload anyway */
        count = 500;
@@ -1436,6 +1433,9 @@ static void pch_spi_pd_remove(struct platform_device *plat_dev)
                free_irq(board_dat->pdev->irq, data);
        }
 
+       if (use_dma)
+               pch_free_dma_buf(board_dat, data);
+
        pci_iounmap(board_dat->pdev, data->io_remap_addr);
 
        spi_controller_put(data->host);