lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 653/717] spi: rpc-if: Fix use-after-free on unbind
    Date
    From: Lukas Wunner <lukas@wunner.de>

    commit 393f981ca5f797b58b882d42b7621fb6e43c7f5b upstream.

    rpcif_spi_remove() accesses the driver's private data after calling
    spi_unregister_controller() even though that function releases the last
    reference on the spi_controller and thereby frees the private data.

    Fix by switching over to the new devm_spi_alloc_master() helper which
    keeps the private data accessible until the driver has unbound.

    Fixes: eb8d6d464a27 ("spi: add Renesas RPC-IF driver")
    Signed-off-by: Lukas Wunner <lukas@wunner.de>
    Cc: <stable@vger.kernel.org> # v5.9+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
    Cc: <stable@vger.kernel.org> # v5.9+
    Cc: Sergei Shtylyov <s.shtylyov@omprussia.ru>
    Link: https://lore.kernel.org/r/c5da472c28021da2f6517441685cef033d40b140.1607286887.git.lukas@wunner.de
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/spi/spi-rpc-if.c | 9 ++-------
    1 file changed, 2 insertions(+), 7 deletions(-)

    --- a/drivers/spi/spi-rpc-if.c
    +++ b/drivers/spi/spi-rpc-if.c
    @@ -134,7 +134,7 @@ static int rpcif_spi_probe(struct platfo
    struct rpcif *rpc;
    int error;

    - ctlr = spi_alloc_master(&pdev->dev, sizeof(*rpc));
    + ctlr = devm_spi_alloc_master(&pdev->dev, sizeof(*rpc));
    if (!ctlr)
    return -ENOMEM;

    @@ -159,13 +159,8 @@ static int rpcif_spi_probe(struct platfo
    error = spi_register_controller(ctlr);
    if (error) {
    dev_err(&pdev->dev, "spi_register_controller failed\n");
    - goto err_put_ctlr;
    + rpcif_disable_rpm(rpc);
    }
    - return 0;
    -
    -err_put_ctlr:
    - rpcif_disable_rpm(rpc);
    - spi_controller_put(ctlr);

    return error;
    }

    \
     
     \ /
      Last update: 2020-12-28 15:40    [W:4.020 / U:1.544 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site