From 9f744689c49defa61238836829202d1473da2ea5 Mon Sep 17 00:00:00 2001 From: Logan Gunthorpe Date: Wed, 2 Sep 2026 00:21:49 -0600 Subject: [PATCH] dmaengine: switchtec-dma: fix use-after-free of swdma_dev in remove() dma_async_device_unregister() can drop the last reference on dma_dev and free swdma_dev synchronously via switchtec_dma_release(), but switchtec_dma_remove() then uses swdma_dev->bar for iounmap(). Cache bar in a local variable before the unregister call. Reported-by: Sashiko Link: https://lore.kernel.org/dmaengine/20260717223431.625EE1F000E9@smtp.kernel.org Reviewed-by: Frank Li Signed-off-by: Logan Gunthorpe Link: https://patch.msgid.link/20260902062153.31048-8-logang@deltatee.com Signed-off-by: Vinod Koul --- drivers/dma/switchtec_dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c index 0ae930de47c8..ddcb6d84bdc6 100644 --- a/drivers/dma/switchtec_dma.c +++ b/drivers/dma/switchtec_dma.c @@ -1380,6 +1380,7 @@ static int switchtec_dma_probe(struct pci_dev *pdev, static void switchtec_dma_remove(struct pci_dev *pdev) { struct switchtec_dma_dev *swdma_dev = pci_get_drvdata(pdev); + void __iomem *bar = swdma_dev->bar; switchtec_dma_chans_release(pdev, swdma_dev); @@ -1392,7 +1393,7 @@ static void switchtec_dma_remove(struct pci_dev *pdev) dma_async_device_unregister(&swdma_dev->dma_dev); - iounmap(swdma_dev->bar); + iounmap(bar); pci_release_mem_regions(pdev); pci_disable_device(pdev); }