BackPup/Linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-25 21:21:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

spi: fsl-dspi: fix use-after-free in remove path

Browse Source 
spi_unregister_controller() not only unregisters the controller, but
also frees the controller. This will free the driver data with it, so
we must not access it later dspi_remove().

Solve this by allocating the driver data separately from the SPI
controller.

Signed-off-by: Sascha Hauer <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
This commit is contained in:
Sascha Hauer
2020-09-23 17:31:14 +01:00
committed by Mark Brown
parent b867eef4cf
commit 530b5affc6
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/spi/spi-fsl-dspi.c
+7 -5
View File
@@ -1273,11 +1273,14 @@ static int dspi_probe(struct platform_device *pdev)
void __iomem *base;
bool big_endian;
ctlr = spi_alloc_master(&pdev->dev, sizeof(struct fsl_dspi));
dspi = devm_kzalloc(&pdev->dev, sizeof(*dspi), GFP_KERNEL);
if (!dspi)
return -ENOMEM;
ctlr = spi_alloc_master(&pdev->dev, 0);
if (!ctlr)
return -ENOMEM;
dspi = spi_controller_get_devdata(ctlr);
dspi->pdev = pdev;
dspi->ctlr = ctlr;
@@ -1414,7 +1417,7 @@ poll_mode:
if (dspi->devtype_data->trans_mode != DSPI_DMA_MODE)
ctlr->ptp_sts_supported = true;
platform_set_drvdata(pdev, ctlr);
platform_set_drvdata(pdev, dspi);
ret = spi_register_controller(ctlr);
if (ret != 0) {
@@ -1437,8 +1440,7 @@ out_ctlr_put:
static int dspi_remove(struct platform_device *pdev)
{
struct spi_controller *ctlr = platform_get_drvdata(pdev);
struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
struct fsl_dspi *dspi = platform_get_drvdata(pdev);
/* Disconnect from the SPI framework */
spi_unregister_controller(dspi->ctlr);