From: Mark Brown <broonie@kernel.org>
To: Lukas Wunner <lukas@wunner.de>
Cc: linux-spi@vger.kernel.org, Han Xu <han.xu@nxp.com>
Subject: Re: [PATCH] spi: lpspi: Fix use-after-free on unbind
Date: Thu, 12 Nov 2020 19:39:40 +0000 [thread overview]
Message-ID: <160520996935.38820.15816205676377338250.b4-ty@kernel.org> (raw)
In-Reply-To: <ab3c0b18bd820501a12c85e440006e09ec0e275f.1604874488.git.lukas@wunner.de>
On Sun, 8 Nov 2020 23:41:00 +0100, Lukas Wunner wrote:
> Normally the last reference on an spi_controller is released by
> spi_unregister_controller(). In the case of the i.MX lpspi driver,
> the spi_controller is registered with devm_spi_register_controller(),
> so spi_unregister_controller() is invoked automatically after the driver
> has unbound.
>
> However the driver already releases the last reference in
> fsl_lpspi_remove() through a gratuitous call to spi_master_put(),
> causing a use-after-free when spi_unregister_controller() is
> subsequently invoked by the devres framework.
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-next
Thanks!
[1/1] spi: lpspi: Fix use-after-free on unbind
commit: 4def49da620c84a682d9361d6bef0a97eed46fe0
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
next prev parent reply other threads:[~2020-11-12 19:39 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-08 22:41 [PATCH] spi: davinci: Fix use-after-free on unbind Lukas Wunner
2020-11-08 22:41 ` [PATCH] spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path Lukas Wunner
2020-11-12 19:39 ` Mark Brown
2020-11-08 22:41 ` [PATCH] spi: synquacer: Disable clock " Lukas Wunner
2020-11-09 14:22 ` Andy Shevchenko
2020-11-09 15:04 ` Lukas Wunner
2020-11-12 19:39 ` Mark Brown
2020-11-08 22:41 ` [PATCH] spi: lpspi: Fix use-after-free on unbind Lukas Wunner
2020-11-12 19:39 ` Mark Brown [this message]
2020-11-08 22:41 ` [PATCH] spi: atmel-quadspi: Disable clock in probe error path Lukas Wunner
2020-11-09 18:56 ` Tudor.Ambarus
2020-11-10 16:03 ` Mark Brown
2020-11-08 22:41 ` [PATCH] spi: pic32: Don't leak DMA channels " Lukas Wunner
2020-11-12 19:39 ` Mark Brown
2020-11-09 7:26 ` [PATCH] spi: davinci: Fix use-after-free on unbind Peter Ujfalusi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=160520996935.38820.15816205676377338250.b4-ty@kernel.org \
--to=broonie@kernel.org \
--cc=han.xu@nxp.com \
--cc=linux-spi@vger.kernel.org \
--cc=lukas@wunner.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.