[PATCH RESEND v6] dma: at_hdmac: Fix use-after-free by proper tasklet cleanup

Vinod Koul vkoul at kernel.org
Thu Sep 3 10:04:39 PDT 2026


On Mon, 27 Jul 2026 14:17:05 +0800, Hongling Zeng wrote:
> Current cleanup paths have a use-after-free vulnerability:
> - vchan_init() creates tasklets that access at_dma_chan memory
> - free_irq() only waits for IRQ handler, NOT tasklets
> - atdma is devm-managed and freed after probe/remove
> - Running tasklets accessing freed memory → Use-After-Free!
> 
> The fix requires careful ordering:
> - free_irq() FIRST to synchronize with running IRQ handlers and prevent
>   them from scheduling new tasklets
> - Then kill tasklets to wait for already-scheduled ones to complete
> - Only then free other resources
> 
> [...]

Applied, thanks!

[1/1] dma: at_hdmac: Fix use-after-free by proper tasklet cleanup
      commit: 00c5236057e36e88d3aca7246dd891cb56b513a7

Best regards,
-- 
~Vinod





More information about the linux-arm-kernel mailing list