If request_irq() succeeds but a later step (self-test or device
registration) fails, the error path at err_free_irq frees the IRQ
but does not kill the tasklet.  A previously scheduled tasklet can
still run after the channel is freed, accessing freed memory.

Add tasklet_kill() after free_irq() on the error path.

Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/dma/mv_xor.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 25ed61f1b089..24f22db5dfa1 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1162,6 +1162,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 
 err_free_irq:
 	free_irq(mv_chan->irq, mv_chan);
+	tasklet_kill(&mv_chan->irq_tasklet);
 err_free_dma:
 	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
-- 
2.55.0

On Wed, 09 Sep 2026 16:46:01 -0700, Rosen Penev wrote:
> If request_irq() succeeds but a later step (self-test or device
> registration) fails, the error path at err_free_irq frees the IRQ
> but does not kill the tasklet.  A previously scheduled tasklet can
> still run after the channel is freed, accessing freed memory.
> 
> Add tasklet_kill() after free_irq() on the error path.
> 
> [...]

Applied, thanks!

[1/1] dmaengine: mv_xor: kill tasklet on channel add error path
      commit: bcb4d469b19d53dc21e4a1da12d4438e7489e150

Best regards,
-- 
~Vinod

On Wed, Sep 09, 2026 at 04:46:01PM -0700, Rosen Penev wrote:
> If request_irq() succeeds but a later step (self-test or device
> registration) fails, the error path at err_free_irq frees the IRQ
> but does not kill the tasklet.  A previously scheduled tasklet can
> still run after the channel is freed, accessing freed memory.
>
> Add tasklet_kill() after free_irq() on the error path.
>
> Fixes: ff7b04796d98 ("dmaengine: DMA engine driver for Marvell XOR engine")
> Assisted-by: opencode:big-pickle
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/mv_xor.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
> index 25ed61f1b089..24f22db5dfa1 100644
> --- a/drivers/dma/mv_xor.c
> +++ b/drivers/dma/mv_xor.c
> @@ -1162,6 +1162,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
>
>  err_free_irq:
>  	free_irq(mv_chan->irq, mv_chan);
> +	tasklet_kill(&mv_chan->irq_tasklet);
>  err_free_dma:
>  	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
>  			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
> --
> 2.55.0
>