From: Nathan Chancellor <natechancellor@gmail.com>
To: Lukas Wunner <lukas@wunner.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.com>,
Mark Brown <broonie@kernel.org>,
Sudip Mukherjee <sudipm.mukherjee@gmail.com>,
stable@vger.kernel.org
Subject: Re: [PATCH 4.19-stable 4/5] spi: bcm2835aux: Fix use-after-free on unbind
Date: Mon, 7 Dec 2020 17:49:01 -0700 [thread overview]
Message-ID: <20201208004901.GB587492@ubuntu-m3-large-x86> (raw)
In-Reply-To: <b0fb1c8837b69d56de2004dce945d0aa33d88357.1607257456.git.lukas@wunner.de>
On Sun, Dec 06, 2020 at 01:31:03PM +0100, Lukas Wunner wrote:
> [ Upstream commit e13ee6cc4781edaf8c7321bee19217e3702ed481 ]
>
> bcm2835aux_spi_remove() accesses the driver's private data after calling
> spi_unregister_master() even though that function releases the last
> reference on the spi_master and thereby frees the private data.
>
> Fix by switching over to the new devm_spi_alloc_master() helper which
> keeps the private data accessible until the driver has unbound.
>
> Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
> Signed-off-by: Lukas Wunner <lukas@wunner.de>
> Cc: <stable@vger.kernel.org> # v4.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
> Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
> Cc: <stable@vger.kernel.org> # v4.4+
> Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
> Signed-off-by: Mark Brown <broonie@kernel.org>
Please ensure that commit d853b3406903 ("spi: bcm2835aux: Restore err
assignment in bcm2835aux_spi_probe") is picked up with this patch in all
of the stable trees that it is applied to.
Cheers,
Nathan
next prev parent reply other threads:[~2020-12-08 0:49 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-06 12:31 [PATCH 4.19-stable 1/5] spi: Introduce device-managed SPI controller allocation Lukas Wunner
2020-12-06 12:31 ` [PATCH 4.19-stable 2/5] spi: bcm-qspi: Fix use-after-free on unbind Lukas Wunner
2020-12-06 12:31 ` [PATCH 4.19-stable 3/5] spi: bcm2835: " Lukas Wunner
2020-12-06 12:31 ` [PATCH 4.19-stable 4/5] spi: bcm2835aux: " Lukas Wunner
2020-12-08 0:49 ` Nathan Chancellor [this message]
2020-12-08 7:32 ` Lukas Wunner
2020-12-08 13:47 ` Sasha Levin
2020-12-08 17:11 ` Lukas Wunner
2020-12-08 20:28 ` Nathan Chancellor
2020-12-08 21:17 ` Sasha Levin
2020-12-09 8:37 ` Lukas Wunner
2020-12-09 9:36 ` Greg KH
2020-12-09 9:38 ` Lukas Wunner
2020-12-09 9:44 ` Greg KH
2020-12-10 7:01 ` Lukas Wunner
2020-12-10 12:45 ` Greg KH
2020-12-10 16:13 ` Lukas Wunner
2020-12-10 19:24 ` Lukas Wunner
2020-12-06 12:31 ` [PATCH 4.19-stable 5/5] spi: bcm2835: Release the DMA channel if probe fails after dma_init Lukas Wunner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201208004901.GB587492@ubuntu-m3-large-x86 \
--to=natechancellor@gmail.com \
--cc=broonie@kernel.org \
--cc=gregkh@linuxfoundation.com \
--cc=lukas@wunner.de \
--cc=stable@vger.kernel.org \
--cc=sudipm.mukherjee@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.