* [PATCH 1/1] spi: fix use after free in of_spi_notify
@ 2022-06-07 15:52 Xiaohui Zhang
2022-06-07 16:20 ` Mark Brown
0 siblings, 1 reply; 2+ messages in thread
From: Xiaohui Zhang @ 2022-06-07 15:52 UTC (permalink / raw)
To: Xiaohui Zhang, Mark Brown, linux-spi, linux-kernel
We can't use "ctlr->dev" after it has been freed.
Signed-off-by: Xiaohui Zhang <xiaohuizhang@ruc.edu.cn>
---
drivers/spi/spi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index b9e2c7e7c580..dadfcdc6c38f 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -4198,14 +4198,15 @@ static int of_spi_notify(struct notifier_block *nb, unsigned long action,
}
spi = of_register_spi_device(ctlr, rd->dn);
- put_device(&ctlr->dev);
if (IS_ERR(spi)) {
pr_err("%s: failed to create for '%pOF'\n",
__func__, rd->dn);
+ put_device(&ctlr->dev);
of_node_clear_flag(rd->dn, OF_POPULATED);
return notifier_from_errno(PTR_ERR(spi));
}
+ put_device(&ctlr->dev);
break;
case OF_RECONFIG_CHANGE_REMOVE:
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 1/1] spi: fix use after free in of_spi_notify
2022-06-07 15:52 [PATCH 1/1] spi: fix use after free in of_spi_notify Xiaohui Zhang
@ 2022-06-07 16:20 ` Mark Brown
0 siblings, 0 replies; 2+ messages in thread
From: Mark Brown @ 2022-06-07 16:20 UTC (permalink / raw)
To: Xiaohui Zhang; +Cc: linux-spi, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 575 bytes --]
On Tue, Jun 07, 2022 at 11:52:33PM +0800, Xiaohui Zhang wrote:
> We can't use "ctlr->dev" after it has been freed.
> spi = of_register_spi_device(ctlr, rd->dn);
> - put_device(&ctlr->dev);
>
> if (IS_ERR(spi)) {
> pr_err("%s: failed to create for '%pOF'\n",
> __func__, rd->dn);
> + put_device(&ctlr->dev);
> of_node_clear_flag(rd->dn, OF_POPULATED);
> return notifier_from_errno(PTR_ERR(spi));
> }
> + put_device(&ctlr->dev);
> break;
Could you be more explicit about where the problematic use of ctlr->dev
is please?
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-06-07 16:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-07 15:52 [PATCH 1/1] spi: fix use after free in of_spi_notify Xiaohui Zhang
2022-06-07 16:20 ` Mark Brown
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).