fsl_dma_chan_remove() frees the fsldma_chan structure without first quiescing the channel's tasklet. If an IRQ fires just before the remove and schedules the tasklet, dma_do_tasklet() runs against the freed channel struct, causing a use-after-free. Add tasklet_kill() before tearing the channel down. Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling") Cc: stable@vger.kernel.org Reported-by: Sashiko Signed-off-by: Aldo Ariel Panzardo --- drivers/dma/fsldma.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c index 22d62d9..0e2f848 100644 --- a/drivers/dma/fsldma.c +++ b/drivers/dma/fsldma.c @@ -1205,6 +1205,7 @@ static int fsl_dma_chan_probe(struct fsldma_device *fdev, static void fsl_dma_chan_remove(struct fsldma_chan *chan) { + tasklet_kill(&chan->tasklet); irq_dispose_mapping(chan->irq); list_del(&chan->common.device_node); iounmap(chan->regs); -- 2.43.0