[PATCH 2/2] mailbox: bcm-pdc: Fix potential use-after-free during removal

[Guangshuo Li]

The remove callback destroys the DMA pools before device-managed
controller removal shuts down requested channels. The shutdown callback
then passes the destroyed ring pool to dma_pool_free().

Unregister the controller explicitly before destroying the pools.

This issue was found by our static analysis tool under development.

Fixes: 6267ee6afae0 ("mailbox: bcm-pdc: Use device-managed registration API")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Build-tested the affected object for arm64 with LLVM (W=1).
No hardware or fault-injection testing was performed.

 drivers/mailbox/bcm-pdc-mailbox.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mailbox/bcm-pdc-mailbox.c b/drivers/mailbox/bcm-pdc-mailbox.c
index 6fcc4002ad4f..fd30b9b06881 100644
--- a/drivers/mailbox/bcm-pdc-mailbox.c
+++ b/drivers/mailbox/bcm-pdc-mailbox.c
@@ -1450,7 +1450,7 @@ static int pdc_mb_init(struct pdc_state *pdcs)
 		mbc->chans[chan_index].con_priv = pdcs;
 
 	/* Register mailbox controller */
-	err = devm_mbox_controller_register(dev, mbc);
+	err = mbox_controller_register(mbc);
 	if (err) {
 		dev_crit(dev,
 			 "Failed to register PDC mailbox controller. Error %d.",
@@ -1608,6 +1608,7 @@ static void pdc_remove(struct platform_device *pdev)
 	cancel_work_sync(&pdcs->rx_work);
 
 	pdc_hw_disable(pdcs);
+	mbox_controller_unregister(&pdcs->mbc);
 
 	dma_pool_destroy(pdcs->rx_buf_pool);
 	dma_pool_destroy(pdcs->ring_pool);
-- 
2.43.0