From bcb4d469b19d53dc21e4a1da12d4438e7489e150 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Wed, 9 Sep 2026 16:46:01 -0700 Subject: [PATCH] dmaengine: mv_xor: kill tasklet on channel add error path If request_irq() succeeds but a later step (self-test or device registration) fails, the error path at err_free_irq frees the IRQ but does not kill the tasklet. A previously scheduled tasklet can still run after the channel is freed, accessing freed memory. Add tasklet_kill() after free_irq() on the error path. Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine") Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev Reviewed-by: Frank Li Link: https://patch.msgid.link/20260909234601.101883-1-rosenp@gmail.com Signed-off-by: Vinod Koul --- drivers/dma/mv_xor.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c index dd4f150d5fb1..c4e0dce3ca64 100644 --- a/drivers/dma/mv_xor.c +++ b/drivers/dma/mv_xor.c @@ -1167,6 +1167,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev, err_free_irq: free_irq(mv_chan->irq, mv_chan); + tasklet_kill(&mv_chan->irq_tasklet); err_free_dma: dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE, mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);