Unverified Commit ad0e9ac2 authored by Felix Gu's avatar Felix Gu Committed by Mark Brown
Browse files

spi: atcspi200: Fix double-free in atcspi_configure_dma() 



The driver uses devm_dma_request_chan() which registers automatic cleanup
via devm_add_action_or_reset(). Calling dma_release_channel() manually on
the RX channel when TX channel request fails causes a double-free when
the devm cleanup runs.

Remove the unnecessary manual cleanup and simplify the error handling
since devm will properly release channels on probe failure or driver
detach.

Fixes: 34e3815e ("spi: atcspi200: Add ATCSPI200 SPI controller driver")
Signed-off-by: default avatarFelix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260305-atcspi2000-v1-1-eafe08dcca60@gmail.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent b20b4376

drivers/spi/spi-atcspi200.c

+7 −21
Original line number Diff line number Diff line
@@ -497,31 +497,17 @@ static int atcspi_init_resources(struct platform_device *pdev, 


static int atcspi_configure_dma(struct atcspi_dev *spi)

{

	struct dma_chan *dma_chan;

	int ret = 0;

	spi->host->dma_rx = devm_dma_request_chan(spi->dev, "rx");

	if (IS_ERR(spi->host->dma_rx))

		return PTR_ERR(spi->host->dma_rx);



	dma_chan = devm_dma_request_chan(spi->dev, "rx");

	if (IS_ERR(dma_chan)) {

		ret = PTR_ERR(dma_chan);

		goto err_exit;

	}

	spi->host->dma_rx = dma_chan;

	spi->host->dma_tx = devm_dma_request_chan(spi->dev, "tx");

	if (IS_ERR(spi->host->dma_tx))

		return PTR_ERR(spi->host->dma_tx);



	dma_chan = devm_dma_request_chan(spi->dev, "tx");

	if (IS_ERR(dma_chan)) {

		ret = PTR_ERR(dma_chan);

		goto free_rx;

	}

	spi->host->dma_tx = dma_chan;

	init_completion(&spi->dma_completion);



	return ret;



free_rx:

	dma_release_channel(spi->host->dma_rx);

	spi->host->dma_rx = NULL;

err_exit:

	return ret;

	return 0;

}



static int atcspi_enable_clk(struct atcspi_dev *spi)