From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B55CA347BDB; Fri, 10 Apr 2026 09:49:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775814580; cv=none; b=bxqOmiI9RmspG7x8oALy9KIx780lHDSVIRfrLuDjYiOCOoCdTWqHDs5x/Ix7Z/fnXgNhtxo8rhF9TzTtHZRJG7E608ChJAA0iogpUYV2ApHpya++P7bwX+oYWJaRLKogmUWgSU6jTzSkC9D7y+Q+BwOgzqsWQW/i3P20ejlvTBs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775814580; c=relaxed/simple; bh=CytAY+vUrvcJliMfskIBZQZ1+nqbDtxvrkk8RxKdCwo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EkKRWg59pIfFPNpor05f67oAnztGcK2VwZKFdoKmla6BRa2xXmh7SEfVvLXuOCexYJD5lE0FhZ6Tj1XNadL94TGMAutSrp82OcwFuk6A5pY1sCcfh8ccLlSsfKWIJ//v6nkHdSgiNwwzMxezaYUia++WCpLTDtMXjcKajVCmga8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=V8DcPnUy; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="V8DcPnUy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 66F6DC19421; Fri, 10 Apr 2026 09:49:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775814580; bh=CytAY+vUrvcJliMfskIBZQZ1+nqbDtxvrkk8RxKdCwo=; h=From:To:Cc:Subject:Date:From; b=V8DcPnUyq55QjOFQSsrfH6XDrIwDODcW0eLK2vZ0UeoNOpdhEahSqRyFuFSt00iM4 qWflQJuBqu1FD0cWNvyoSK9YeSTL858A4dFmEmW1zAoI6g1SQGQH/xGlLGX0PPRAdk PGuCRJjl4NmQjKB/xIftbAYSZS10UrWafxaL756qX/RaZR4MFt5qwrSEVCuegsbNma FJBXWTWdk/OjW4Qe/24s50+Wg9kVFq2Ep3pxScpV6liHkY3pKa6t7eOVtIf+iCdjJe QNAFbwU9SwH+cGXkN4wyEW/GaAZ95F7JnCou1GEgkYzFf+O3RrmTC0b0Z3udyLftDr BQlqEZ1Zxqmjg== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1wB8Uc-00000002Aqk-0eKl; Fri, 10 Apr 2026 11:49:38 +0200 From: Johan Hovold To: Mark Brown Cc: Andi Shyti , Tudor Ambarus , linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Adithya K V Subject: [PATCH] spi: s3c64xx: fix NULL-deref on driver unbind Date: Fri, 10 Apr 2026 11:49:25 +0200 Message-ID: <20260410094925.518343-1-johan@kernel.org> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit A change moving DMA channel allocation from probe() back to s3c64xx_spi_prepare_transfer() failed to remove the corresponding deallocation from remove(). Drop the bogus DMA channel release from remove() to avoid triggering a NULL-pointer dereference on driver unbind. This issue was flagged by Sashiko when reviewing a controller deregistration fix. Fixes: f52b03c70744 ("spi: s3c64xx: requests spi-dma channel only during data transfer") Cc: stable@vger.kernel.org # 6.0 Cc: Adithya K V Link: https://sashiko.dev/#/patchset/20260410081757.503099-1-johan%40kernel.org Signed-off-by: Johan Hovold --- Note that this one should be applied on top of the deregistration fixes: https://lore.kernel.org/lkml/20260410081757.503099-1-johan@kernel.org/ to avoid a (trivial) conflict if applied in reverse order. Johan drivers/spi/spi-s3c64xx.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c index 95b61264b679..37176e557099 100644 --- a/drivers/spi/spi-s3c64xx.c +++ b/drivers/spi/spi-s3c64xx.c @@ -1403,11 +1403,6 @@ static void s3c64xx_spi_remove(struct platform_device *pdev) writel(0, sdd->regs + S3C64XX_SPI_INT_EN); - if (!is_polling(sdd)) { - dma_release_channel(sdd->rx_dma.ch); - dma_release_channel(sdd->tx_dma.ch); - } - pm_runtime_put_noidle(&pdev->dev); pm_runtime_disable(&pdev->dev); pm_runtime_set_suspended(&pdev->dev); -- 2.52.0