[PATCH] dmaengine: fsldma: kill the channel tasklet on remove

[PATCH] dmaengine: fsldma: kill the channel tasklet on remove

[Aldo Ariel Panzardo]

fsl_dma_chan_remove() frees the fsldma_chan structure without first
quiescing the channel's tasklet. If an IRQ fires just before the
remove and schedules the tasklet, dma_do_tasklet() runs against the
freed channel struct, causing a use-after-free.

Add tasklet_kill() before tearing the channel down.

Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 drivers/dma/fsldma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 22d62d9..0e2f848 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1205,6 +1205,7 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev,
 
 static void fsl_dma_chan_remove(struct fsldma_chan *chan)
 {
+	tasklet_kill(&chan->tasklet);
 	irq_dispose_mapping(chan->irq);
 	list_del(&chan->common.device_node);
 	iounmap(chan->regs);
-- 
2.43.0

Re: [PATCH] dmaengine: fsldma: kill the channel tasklet on remove

[Aldo Ariel]

[-- Attachment #1: Type: text/plain, Size: 1399 bytes --]

Hi,

Following up on this tasklet teardown fix sent September 23.

Is there any additional testing or any change needed for review?
I'm happy to work on it. Please let me know if another reviewer
would be better placed to look at this driver.

Thanks,
Aldo



On Wed, 23 Sep 2026 10:53:01 -0300, Aldo Ariel Panzardo <qwe.aldo@gmail.com>
wrote:
> fsl_dma_chan_remove() frees the fsldma_chan structure without first
> quiescing the channel's tasklet. If an IRQ fires just before the
> remove and schedules the tasklet, dma_do_tasklet() runs against the
> freed channel struct, causing a use-after-free.
>
> Add tasklet_kill() before tearing the channel down.
>
> Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> ---
>  drivers/dma/fsldma.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
> index 22d62d9..0e2f848 100644
> --- a/drivers/dma/fsldma.c
> +++ b/drivers/dma/fsldma.c
> @@ -1205,6 +1205,7 @@ static int fsl_dma_chan_probe(struct fsldma_device
*fdev,
>
>  static void fsl_dma_chan_remove(struct fsldma_chan *chan)
>  {
> +     tasklet_kill(&chan->tasklet);
>       irq_dispose_mapping(chan->irq);
>       list_del(&chan->common.device_node);
>       iounmap(chan->regs);
> --
> 2.43.0

[-- Attachment #2: Type: text/html, Size: 2095 bytes --]

[PATCH] dmaengine: fsldma: kill the channel tasklet on remove

[Aldo Ariel Panzardo]

fsl_dma_chan_remove() frees the fsldma_chan structure without first
quiescing the channel's tasklet. If an IRQ fires just before the
remove and schedules the tasklet, dma_do_tasklet() runs against the
freed channel struct, causing a use-after-free.

Add tasklet_kill() before tearing the channel down.

Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 drivers/dma/fsldma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 22d62d9..0e2f848 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -1205,6 +1205,7 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev,
 
 static void fsl_dma_chan_remove(struct fsldma_chan *chan)
 {
+	tasklet_kill(&chan->tasklet);
 	irq_dispose_mapping(chan->irq);
 	list_del(&chan->common.device_node);
 	iounmap(chan->regs);
-- 
2.43.0