If dma_request_chan(&pdev->dev, "tx") fails during ep93xx_pata_dma_init(),
drv_data->dma_tx_channel holds an ERR_PTR. The error path at
fail_release_rx releases dma_rx_channel but does not NULL the pointer,
then falls through to ep93xx_pata_release_dma() which attempts to release
dma_rx_channel again (double free) and calls dma_release_channel() on the
ERR_PTR dma_tx_channel (invalid pointer dereference).

Fix by NULLing dma_tx_channel before falling through to
ep93xx_pata_release_dma(), which will then clean up dma_rx_channel.

Fixes: 9963113e3a92 ("ata: pata_ep93xx: add device tree support")
Assisted-by: Opencode:Big-Pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/ata/pata_ep93xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
index b2b9e0058333..aa6f8172925d 100644
--- a/drivers/ata/pata_ep93xx.c
+++ b/drivers/ata/pata_ep93xx.c
@@ -688,7 +688,7 @@ static int ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
 	return 0;
 
 fail_release_rx:
-	dma_release_channel(drv_data->dma_rx_channel);
+	drv_data->dma_tx_channel = NULL;
 fail_release_dma:
 	ep93xx_pata_release_dma(drv_data);
 
-- 
2.54.0