Messages in this thread | | | Date | Thu, 18 Mar 2021 08:22:38 +0100 | From | Alain Volmat <> | Subject | Re: [PATCH] spi: stm32: drop devres version of spi_register_master |
| |
Hi Lukas,
On Tue, Mar 16, 2021 at 10:17:44PM +0100, Lukas Wunner wrote: > On Fri, Mar 12, 2021 at 11:34:46AM +0100, Alain Volmat wrote: > > --- a/drivers/spi/spi-stm32.c > > +++ b/drivers/spi/spi-stm32.c > > @@ -1960,6 +1960,7 @@ static int stm32_spi_remove(struct platform_device *pdev) > > struct spi_master *master = platform_get_drvdata(pdev); > > struct stm32_spi *spi = spi_master_get_devdata(master); > > > > + spi_unregister_master(master); > > spi->cfg->disable(spi); > > > > if (master->dma_tx) > > This introduces a use-after-free because spi_unregister_master() > drops the last reference on the spi_master allocation (which includes > the struct stm32_spi), causing it to be freed, yet the stm32_spi > struct is accessed afterwards.
Indeed. Thanks. I've fixed that and will post it.
> You need to convert the driver to devm_spi_alloc_master() to > fix the use-after-free. See commit 6cfd39e212de for an example. > > Thanks, > > Lukas
| |