From: Lukas Wunner <lukas@wunner.de>
To: Mark Brown <broonie@kernel.org>
Cc: linux-spi@vger.kernel.org, Han Xu <han.xu@nxp.com>
Subject: [PATCH] spi: lpspi: Fix use-after-free on unbind
Date: Sun, 8 Nov 2020 23:41:00 +0100 [thread overview]
Message-ID: <ab3c0b18bd820501a12c85e440006e09ec0e275f.1604874488.git.lukas@wunner.de> (raw)
In-Reply-To: <dd060534490eca5e946eb9165916542b01a9358d.1604874488.git.lukas@wunner.de>
Normally the last reference on an spi_controller is released by
spi_unregister_controller(). In the case of the i.MX lpspi driver,
the spi_controller is registered with devm_spi_register_controller(),
so spi_unregister_controller() is invoked automatically after the driver
has unbound.
However the driver already releases the last reference in
fsl_lpspi_remove() through a gratuitous call to spi_master_put(),
causing a use-after-free when spi_unregister_controller() is
subsequently invoked by the devres framework.
Fix by dropping the superfluous spi_master_put().
Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.2+
Cc: Han Xu <han.xu@nxp.com>
---
drivers/spi/spi-fsl-lpspi.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
index 986b9793fd3c..a2886ee44e4c 100644
--- a/drivers/spi/spi-fsl-lpspi.c
+++ b/drivers/spi/spi-fsl-lpspi.c
@@ -938,9 +938,6 @@ static int fsl_lpspi_remove(struct platform_device *pdev)
spi_controller_get_devdata(controller);
pm_runtime_disable(fsl_lpspi->dev);
-
- spi_master_put(controller);
-
return 0;
}
--
2.28.0
next prev parent reply other threads:[~2020-11-08 22:49 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-08 22:41 [PATCH] spi: davinci: Fix use-after-free on unbind Lukas Wunner
2020-11-08 22:41 ` [PATCH] spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path Lukas Wunner
2020-11-12 19:39 ` Mark Brown
2020-11-08 22:41 ` [PATCH] spi: synquacer: Disable clock " Lukas Wunner
2020-11-09 14:22 ` Andy Shevchenko
2020-11-09 15:04 ` Lukas Wunner
2020-11-12 19:39 ` Mark Brown
2020-11-08 22:41 ` Lukas Wunner [this message]
2020-11-12 19:39 ` [PATCH] spi: lpspi: Fix use-after-free on unbind Mark Brown
2020-11-08 22:41 ` [PATCH] spi: atmel-quadspi: Disable clock in probe error path Lukas Wunner
2020-11-09 18:56 ` Tudor.Ambarus
2020-11-10 16:03 ` Mark Brown
2020-11-08 22:41 ` [PATCH] spi: pic32: Don't leak DMA channels " Lukas Wunner
2020-11-12 19:39 ` Mark Brown
2020-11-09 7:26 ` [PATCH] spi: davinci: Fix use-after-free on unbind Peter Ujfalusi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ab3c0b18bd820501a12c85e440006e09ec0e275f.1604874488.git.lukas@wunner.de \
--to=lukas@wunner.de \
--cc=broonie@kernel.org \
--cc=han.xu@nxp.com \
--cc=linux-spi@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.