When LCLA is placed in ESRAM, d40_probe() stores a devm_ioremap() address in lcla_pool.base and leaves base_unaligned unset. The destroy_cache error path can then pass the ioremap address to free_pages().
Only free lcla_pool.base with free_pages() when the driver allocated the LCLA pool from normal memory. The ESRAM mapping is devm-managed. Reported-by: [email protected] Closes: https://lore.kernel.org/dmaengine/[email protected]/ Assisted-by: Codex:gpt-5-5 Signed-off-by: Linus Walleij <[email protected]> --- drivers/dma/ste_dma40.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c index 804eb5eab06b..739e47941d0c 100644 --- a/drivers/dma/ste_dma40.c +++ b/drivers/dma/ste_dma40.c @@ -3667,7 +3667,8 @@ static int __init d40_probe(struct platform_device *pdev) SZ_1K * base->num_phy_chans, DMA_TO_DEVICE); - if (!base->lcla_pool.base_unaligned && base->lcla_pool.base) + if (!base->plat_data->use_esram_lcla && + !base->lcla_pool.base_unaligned && base->lcla_pool.base) free_pages((unsigned long)base->lcla_pool.base, base->lcla_pool.alloc_order); -- 2.55.0
