mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-08-30 15:43:08 -04:00
aacf3a6c47
The driver uses devm_request_irq() for the IRQ, but cleans up the tasklet and DMA rings inside the remove function. Since devres frees the IRQ only after the remove function returns, a window exists where a pending hardware interrupt can reschedule the tasklet after it has been killed, leading to use-after-free of the descriptor rings. Fix by switching to plain request_irq() and adding the corresponding free_irq() calls in the remove function and the probe error path before tasklet_kill(), ensuring the IRQ is fully torn down before the tasklet is killed. Rename goto error path to err_tasklet as that's more descriptive. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>