Re: [PATCH v6 5/5] dmaengine: fsl-edma: fix use-after-free after dev_pm_domain_detach()

[Frank Li]

On Wed, Jul 01, 2026 at 05:29:27PM +0800, joy.zou@xxxxxxxxxxx wrote:
> From: Joy Zou <joy.zou@xxxxxxx>
>
> Remove pm_runtime_set_suspended() call after dev_pm_domain_detach()

s/Remove/move

> to prevent use-after-free. When a power domain is attached via
> dev_pm_domain_attach_by_id(), calling dev_pm_domain_detach()
> unregisters and frees the underlying virtual device, making

what's means of "underlying virtual devic"

> fsl_chan->pd_dev a dangling pointer.
>
> Accessing the freed pointer in pm_runtime_set_suspended() triggers
> undefined behavior and potential crashes.

Need this paragraph, every one know that. UAF is common issue.

Frank
>
> Fixes: ccfa3131d4a0 ("dmaengine: fsl-edma: implement the cleanup path of fsl_edma3_attach_pd()")
>
> Signed-off-by: Joy Zou <joy.zou@xxxxxxx>
> ---
>  drivers/dma/fsl-edma-main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/fsl-edma-main.c b/drivers/dma/fsl-edma-main.c
> index 3518dfb4292d..266cc082a9f0 100644
> --- a/drivers/dma/fsl-edma-main.c
> +++ b/drivers/dma/fsl-edma-main.c
> @@ -671,8 +671,8 @@ static void fsl_edma3_detach_pd(struct fsl_edma_engine *fsl_edma)
>  			fsl_chan->pd_dev_link = NULL;
>  		}
>  		if (fsl_chan->pd_dev) {
> -			dev_pm_domain_detach(fsl_chan->pd_dev, false);
>  			pm_runtime_set_suspended(fsl_chan->pd_dev);
> +			dev_pm_domain_detach(fsl_chan->pd_dev, false);
>  		}
>  	}
>  }
>
> --
> 2.34.1
>