Unverified Commit 9d72732f authored by Johan Hovold's avatar Johan Hovold Committed by Mark Brown
Browse files

spi: topcliff-pch: fix use-after-free on unbind 



Give the driver a chance to flush its queue before releasing the DMA
buffers on driver unbind

Fixes: c37f3c27 ("spi/topcliff_pch: DMA support")
Cc: stable@vger.kernel.org	# 3.1
Cc: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-9-johan@kernel.org


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 5d6f477d

drivers/spi/spi-topcliff-pch.c

+3 −3
Original line number Diff line number Diff line
@@ -1410,9 +1410,6 @@ static void pch_spi_pd_remove(struct platform_device *plat_dev) 


	spi_unregister_controller(data->host);



	if (use_dma)

		pch_free_dma_buf(board_dat, data);



	/* check for any pending messages; no action is taken if the queue

	 * is still full; but at least we tried.  Unload anyway */

	count = 500;
@@ -1436,6 +1433,9 @@ static void pch_spi_pd_remove(struct platform_device *plat_dev) 
		free_irq(board_dat->pdev->irq, data);

	}



	if (use_dma)

		pch_free_dma_buf(board_dat, data);



	pci_iounmap(board_dat->pdev, data->io_remap_addr);



	spi_controller_put(data->host);