Device-managed controller removal runs after the remove callback has destroyed the DMA pools and MSI mappings. Shutting down a requested channel then frees its rings through the destroyed pools. Unregister the controller explicitly before releasing these resources. This issue was found by our static analysis tool under development. Fixes: 0cafc12ab9cc ("mailbox: bcm-flexrm: Use device-managed registration API") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- Build-tested the affected object for arm64 with LLVM (W=1). No hardware or fault-injection testing was performed. drivers/mailbox/bcm-flexrm-mailbox.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c index 04c47eadf950..e14f49f534d2 100644 --- a/drivers/mailbox/bcm-flexrm-mailbox.c +++ b/drivers/mailbox/bcm-flexrm-mailbox.c @@ -1619,7 +1619,7 @@ static int flexrm_mbox_probe(struct platform_device *pdev) mbox->controller.chans[index].con_priv = &mbox->rings[index]; /* Register mailbox controller */ - ret = devm_mbox_controller_register(dev, &mbox->controller); + ret = mbox_controller_register(&mbox->controller); if (ret) goto fail_free_debugfs_root; @@ -1644,6 +1644,8 @@ static void flexrm_mbox_remove(struct platform_device *pdev) struct device *dev = &pdev->dev; struct flexrm_mbox *mbox = platform_get_drvdata(pdev); + mbox_controller_unregister(&mbox->controller); + debugfs_remove_recursive(mbox->root); platform_device_msi_free_irqs_all(dev); -- 2.43.0 The remove callback destroys the DMA pools before device-managed controller removal shuts down requested channels. The shutdown callback then passes the destroyed ring pool to dma_pool_free(). Unregister the controller explicitly before destroying the pools. This issue was found by our static analysis tool under development. Fixes: 6267ee6afae0 ("mailbox: bcm-pdc: Use device-managed registration API") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- Build-tested the affected object for arm64 with LLVM (W=1). No hardware or fault-injection testing was performed. drivers/mailbox/bcm-pdc-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/mailbox/bcm-pdc-mailbox.c b/drivers/mailbox/bcm-pdc-mailbox.c index 6fcc4002ad4f..fd30b9b06881 100644 --- a/drivers/mailbox/bcm-pdc-mailbox.c +++ b/drivers/mailbox/bcm-pdc-mailbox.c @@ -1450,7 +1450,7 @@ static int pdc_mb_init(struct pdc_state *pdcs) mbc->chans[chan_index].con_priv = pdcs; /* Register mailbox controller */ - err = devm_mbox_controller_register(dev, mbc); + err = mbox_controller_register(mbc); if (err) { dev_crit(dev, "Failed to register PDC mailbox controller. Error %d.", @@ -1608,6 +1608,7 @@ static void pdc_remove(struct platform_device *pdev) cancel_work_sync(&pdcs->rx_work); pdc_hw_disable(pdcs); + mbox_controller_unregister(&pdcs->mbc); dma_pool_destroy(pdcs->rx_buf_pool); dma_pool_destroy(pdcs->ring_pool); -- 2.43.0