[PATCH v6 5/5] dmaengine: fsl-edma: fix use-after-free after dev_pm_domain_detach()

[joy . zou]

From: Joy Zou <joy.zou@xxxxxxx>

Remove pm_runtime_set_suspended() call after dev_pm_domain_detach()
to prevent use-after-free. When a power domain is attached via
dev_pm_domain_attach_by_id(), calling dev_pm_domain_detach()
unregisters and frees the underlying virtual device, making
fsl_chan->pd_dev a dangling pointer.

Accessing the freed pointer in pm_runtime_set_suspended() triggers
undefined behavior and potential crashes.

Fixes: ccfa3131d4a0 ("dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()")

Signed-off-by: Joy Zou <joy.zou@xxxxxxx>
---
 drivers/dma/fsl-edma-main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
index 3518dfb4292d..266cc082a9f0 100644
--- a/drivers/dma/fsl-edma-main.c
+++ b/drivers/dma/fsl-edma-main.c
@@ -671,8 +671,8 @@ static void fsl_edma3_detach_pd(struct fsl_edma_engine *fsl_edma)
 			fsl_chan->pd_dev_link = NULL;
 		}
 		if (fsl_chan->pd_dev) {
-			dev_pm_domain_detach(fsl_chan->pd_dev, false);
 			pm_runtime_set_suspended(fsl_chan->pd_dev);
+			dev_pm_domain_detach(fsl_chan->pd_dev, false);
 		}
 	}
 }

-- 
2.34.1