Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

spi: atcspi200: Fix double-free in atcspi_configure_dma()

The driver uses devm_dma_request_chan() which registers automatic cleanup
via devm_add_action_or_reset(). Calling dma_release_channel() manually on
the RX channel when TX channel request fails causes a double-free when
the devm cleanup runs.

Remove the unnecessary manual cleanup and simplify the error handling
since devm will properly release channels on probe failure or driver
detach.

Fixes: 34e3815ea459 ("spi: atcspi200: Add ATCSPI200 SPI controller driver")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260305-atcspi2000-v1-1-eafe08dcca60@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

authored by

Felix Gu and committed by
Mark Brown
ad0e9ac2 b20b4376

+7 -21
+7 -21
drivers/spi/spi-atcspi200.c
··· 497 497 498 498 static int atcspi_configure_dma(struct atcspi_dev *spi) 499 499 { 500 - struct dma_chan *dma_chan; 501 - int ret = 0; 500 + spi->host->dma_rx = devm_dma_request_chan(spi->dev, "rx"); 501 + if (IS_ERR(spi->host->dma_rx)) 502 + return PTR_ERR(spi->host->dma_rx); 502 503 503 - dma_chan = devm_dma_request_chan(spi->dev, "rx"); 504 - if (IS_ERR(dma_chan)) { 505 - ret = PTR_ERR(dma_chan); 506 - goto err_exit; 507 - } 508 - spi->host->dma_rx = dma_chan; 504 + spi->host->dma_tx = devm_dma_request_chan(spi->dev, "tx"); 505 + if (IS_ERR(spi->host->dma_tx)) 506 + return PTR_ERR(spi->host->dma_tx); 509 507 510 - dma_chan = devm_dma_request_chan(spi->dev, "tx"); 511 - if (IS_ERR(dma_chan)) { 512 - ret = PTR_ERR(dma_chan); 513 - goto free_rx; 514 - } 515 - spi->host->dma_tx = dma_chan; 516 508 init_completion(&spi->dma_completion); 517 509 518 - return ret; 519 - 520 - free_rx: 521 - dma_release_channel(spi->host->dma_rx); 522 - spi->host->dma_rx = NULL; 523 - err_exit: 524 - return ret; 510 + return 0; 525 511 } 526 512 527 513 static int atcspi_enable_clk(struct atcspi_dev *spi)