From: Florian Fainelli <f.fainelli@gmail.com>
To: Lukas Wunner <lukas@wunner.de>, Mark Brown <broonie@kernel.org>
Cc: linux-spi@vger.kernel.org, Vladimir Oltean <olteanv@gmail.com>,
Sascha Hauer <s.hauer@pengutronix.de>,
Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Subject: Re: [PATCH 2/4] spi: bcm2835: Fix use-after-free on unbind
Date: Wed, 11 Nov 2020 12:18:38 -0800 [thread overview]
Message-ID: <898d4aff-8d37-27a6-242c-3b19541faaec@gmail.com> (raw)
In-Reply-To: <ad66e0a0ad96feb848814842ecf5b6a4539ef35c.1605121038.git.lukas@wunner.de>
On 11/11/20 11:07 AM, Lukas Wunner wrote:
> bcm2835_spi_remove() accesses the driver's private data after calling
> spi_unregister_controller() even though that function releases the last
> reference on the spi_controller and thereby frees the private data.
>
> Fix by switching over to the new devm_spi_alloc_master() helper which
> keeps the private data accessible until the driver has unbound.
>
> Fixes: f8043872e796 ("spi: add driver for BCM2835")
> Reported-by: Sascha Hauer <s.hauer@pengutronix.de>
> Reported-by: Florian Fainelli <f.fainelli@gmail.com>
> Signed-off-by: Lukas Wunner <lukas@wunner.de>
> Cc: <stable@vger.kernel.org> # v3.10+: 123456789abc: spi: Introduce device-managed SPI controller allocation
> Cc: <stable@vger.kernel.org> # v3.10+
> Cc: Vladimir Oltean <olteanv@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
--
Florian
next prev parent reply other threads:[~2020-11-11 20:18 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-13 23:48 Use after free in bcm2835_spi_remove() Florian Fainelli
2020-10-14 14:09 ` Lukas Wunner
2020-10-14 19:40 ` Vladimir Oltean
2020-10-14 20:25 ` Mark Brown
2020-10-14 21:20 ` Florian Fainelli
2020-10-22 12:12 ` Lukas Wunner
2020-10-15 5:38 ` Lukas Wunner
2020-10-15 12:53 ` Mark Brown
2020-10-28 9:59 ` Lukas Wunner
2020-10-29 22:24 ` Mark Brown
2020-11-11 19:07 ` [PATCH 0/4] Use-after-free be gone Lukas Wunner
2020-11-11 19:07 ` [PATCH 1/4] spi: Introduce device-managed SPI controller allocation Lukas Wunner
2020-11-11 19:07 ` [PATCH 2/4] spi: bcm2835: Fix use-after-free on unbind Lukas Wunner
2020-11-11 20:18 ` Florian Fainelli [this message]
2020-11-11 19:07 ` [PATCH 3/4] spi: bcm2835aux: " Lukas Wunner
2020-11-11 19:07 ` [PATCH 4/4] spi: bcm-qspi: " Lukas Wunner
2020-11-11 21:12 ` Florian Fainelli
2020-11-12 13:50 ` [PATCH 0/4] Use-after-free be gone Mark Brown
2020-11-12 19:39 ` Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=898d4aff-8d37-27a6-242c-3b19541faaec@gmail.com \
--to=f.fainelli@gmail.com \
--cc=broonie@kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=lukas@wunner.de \
--cc=nsaenzjulienne@suse.de \
--cc=olteanv@gmail.com \
--cc=s.hauer@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.