esp_sun3x_probe() maps both the ESP registers and DMA registers with ioremap(). The probe failure path unmaps both regions, but the normal remove path does not perform the corresponding cleanup. As a result, both MMIO mappings remain allocated after the driver is removed. Unmap the DMA and ESP register regions before releasing the SCSI host, matching the probe error path. This issue was found by manual code inspection. Fixes: 0bb67f181834 ("[SCSI] sun3x_esp: convert to esp_scsi") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/scsi/sun3x_esp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/sun3x_esp.c b/drivers/scsi/sun3x_esp.c index 365406885b8e..101d3b0f8f2f 100644 --- a/drivers/scsi/sun3x_esp.c +++ b/drivers/scsi/sun3x_esp.c @@ -259,7 +259,8 @@ static void esp_sun3x_remove(struct platform_device *dev) dma_free_coherent(esp->dev, 16, esp->command_block, esp->command_block_dma); - + iounmap(esp->dma_regs); + iounmap(esp->regs); scsi_host_put(esp->host); } -- 2.43.0