cpu_pm_notify() walks the raw notifier chain under rcu_read_lock(),
while cpu_pm_unregister_notifier() only unlinks the notifier block.
The controller is devres allocated and can be freed shortly after
remove returns. Wait for an RCU grace period after unregistering the
CPU PM notifier so concurrent CPU PM readers cannot dereference a
freed notifier block.
Fixes: 4c74ecf79227 ("dmaengine: ti: omap-dma: Add device tree match data and
use it for cpu_pm")
Cc: [email protected]
Assisted-by: Codex:GPT-5
Signed-off-by: Rosen Penev <[email protected]>
---
drivers/dma/ti/omap-dma.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
index 0f6dd6b0a301..15be3c90440a 100644
--- a/drivers/dma/ti/omap-dma.c
+++ b/drivers/dma/ti/omap-dma.c
@@ -14,6 +14,7 @@
#include <linux/module.h>
#include <linux/omap-dma.h>
#include <linux/platform_device.h>
+#include <linux/rcupdate.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/of.h>
@@ -1853,8 +1854,10 @@ static void omap_dma_remove(struct platform_device *pdev)
struct omap_dmadev *od = platform_get_drvdata(pdev);
int irq;
- if (od->cfg->may_lose_context)
+ if (od->cfg->may_lose_context) {
cpu_pm_unregister_notifier(&od->nb);
+ synchronize_rcu();
+ }
if (pdev->dev.of_node)
of_dma_controller_free(pdev->dev.of_node);
--
2.54.0
