Re: [PATCH v3 08/11] dmaengine: switchtec-dma: fix use-after-free of swdma_dev in remove()

On Mon, Jul 27, 2026 at 12:15:23PM -0600, Logan Gunthorpe wrote:
> dma_async_device_unregister() can drop the last reference on dma_dev
> and free swdma_dev synchronously via switchtec_dma_release(), but
> switchtec_dma_remove() then uses swdma_dev->bar for iounmap().
>
> Cache bar in a local variable before the unregister call.
>
> Reported-by: Sashiko <[email protected]>
> Link: https://lore.kernel.org/dmaengine/[email protected]
> Signed-off-by: Logan Gunthorpe <[email protected]>
> ---

Reviewed-by: Frank Li <[email protected]>

>  drivers/dma/switchtec_dma.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dma/switchtec_dma.c b/drivers/dma/switchtec_dma.c
> index 800d8ecd0717..d73506b5cabc 100644
> --- a/drivers/dma/switchtec_dma.c
> +++ b/drivers/dma/switchtec_dma.c
> @@ -1384,6 +1384,7 @@ static int switchtec_dma_probe(struct pci_dev *pdev,
>  static void switchtec_dma_remove(struct pci_dev *pdev)
>  {
>  	struct switchtec_dma_dev *swdma_dev = pci_get_drvdata(pdev);
> +	void __iomem *bar = swdma_dev->bar;
>
>  	switchtec_dma_chans_release(pdev, swdma_dev);
>
> @@ -1396,7 +1397,7 @@ static void switchtec_dma_remove(struct pci_dev *pdev)
>
>  	dma_async_device_unregister(&swdma_dev->dma_dev);
>
> -	iounmap(swdma_dev->bar);
> +	iounmap(bar);
>  	pci_release_mem_regions(pdev);
>  	pci_disable_device(pdev);
>  }
> --
> 2.47.3
>