* [PATCH] spi: s3c64xx: fix NULL-deref on driver unbind
@ 2026-04-10 9:49 Johan Hovold
0 siblings, 0 replies; only message in thread
From: Johan Hovold @ 2026-04-10 9:49 UTC (permalink / raw)
To: Mark Brown
Cc: Andi Shyti, Tudor Ambarus, linux-spi, linux-kernel, Johan Hovold,
stable, Adithya K V
A change moving DMA channel allocation from probe() back to
s3c64xx_spi_prepare_transfer() failed to remove the corresponding
deallocation from remove().
Drop the bogus DMA channel release from remove() to avoid triggering a
NULL-pointer dereference on driver unbind.
This issue was flagged by Sashiko when reviewing a controller
deregistration fix.
Fixes: f52b03c70744 ("spi: s3c64xx: requests spi-dma channel only during data transfer")
Cc: stable@vger.kernel.org # 6.0
Cc: Adithya K V <adithya.kv@samsung.com>
Link: https://sashiko.dev/#/patchset/20260410081757.503099-1-johan%40kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
---
Note that this one should be applied on top of the deregistration fixes:
https://lore.kernel.org/lkml/20260410081757.503099-1-johan@kernel.org/
to avoid a (trivial) conflict if applied in reverse order.
Johan
drivers/spi/spi-s3c64xx.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
index 95b61264b679..37176e557099 100644
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -1403,11 +1403,6 @@ static void s3c64xx_spi_remove(struct platform_device *pdev)
writel(0, sdd->regs + S3C64XX_SPI_INT_EN);
- if (!is_polling(sdd)) {
- dma_release_channel(sdd->rx_dma.ch);
- dma_release_channel(sdd->tx_dma.ch);
- }
-
pm_runtime_put_noidle(&pdev->dev);
pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);
--
2.52.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-04-10 9:49 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-10 9:49 [PATCH] spi: s3c64xx: fix NULL-deref on driver unbind Johan Hovold
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox