[PATCH 1/2] mailbox: bcm-flexrm: Fix potential use-after-free during removal

[Guangshuo Li]

Device-managed controller removal runs after the remove callback has
destroyed the DMA pools and MSI mappings. Shutting down a requested
channel then frees its rings through the destroyed pools.

Unregister the controller explicitly before releasing these resources.

This issue was found by our static analysis tool under development.

Fixes: 0cafc12ab9cc ("mailbox: bcm-flexrm: Use device-managed registration API")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Build-tested the affected object for arm64 with LLVM (W=1).
No hardware or fault-injection testing was performed.

 drivers/mailbox/bcm-flexrm-mailbox.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mailbox/bcm-flexrm-mailbox.c b/drivers/mailbox/bcm-flexrm-mailbox.c
index 04c47eadf950..e14f49f534d2 100644
--- a/drivers/mailbox/bcm-flexrm-mailbox.c
+++ b/drivers/mailbox/bcm-flexrm-mailbox.c
@@ -1619,7 +1619,7 @@ static int flexrm_mbox_probe(struct platform_device *pdev)
 		mbox->controller.chans[index].con_priv = &mbox->rings[index];
 
 	/* Register mailbox controller */
-	ret = devm_mbox_controller_register(dev, &mbox->controller);
+	ret = mbox_controller_register(&mbox->controller);
 	if (ret)
 		goto fail_free_debugfs_root;
 
@@ -1644,6 +1644,8 @@ static void flexrm_mbox_remove(struct platform_device *pdev)
 	struct device *dev = &pdev->dev;
 	struct flexrm_mbox *mbox = platform_get_drvdata(pdev);
 
+	mbox_controller_unregister(&mbox->controller);
+
 	debugfs_remove_recursive(mbox->root);
 
 	platform_device_msi_free_irqs_all(dev);
-- 
2.43.0