leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

spi: fsl-dspi: fix use-after-free in remove path

Browse Source 
spi_unregister_controller() not only unregisters the controller, but
also frees the controller. This will free the driver data with it, so
we must not access it later dspi_remove().

Solve this by allocating the driver data separately from the SPI
controller.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Link: https://lore.kernel.org/r/20200923131026.20707-1-s.hauer@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Sascha Hauer 2020-09-23 15:10:26 +02:00 committed by Mark Brown
parent b867eef4cf
commit 530b5affc6
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/spi/spi-fsl-dspi.c
View File

@ -1273,11 +1273,14 @@ static int dspi_probe(struct platform_device *pdev)
void __iomem *base; void __iomem *base;
bool big_endian; bool big_endian;
ctlr = spi_alloc_master(&pdev->dev, sizeof(struct fsl_dspi)); dspi = devm_kzalloc(&pdev->dev, sizeof(*dspi), GFP_KERNEL);
if (!dspi)
return -ENOMEM;
ctlr = spi_alloc_master(&pdev->dev, 0);
if (!ctlr) if (!ctlr)
return -ENOMEM; return -ENOMEM;
dspi = spi_controller_get_devdata(ctlr);
dspi->pdev = pdev; dspi->pdev = pdev;
dspi->ctlr = ctlr; dspi->ctlr = ctlr;
@ -1414,7 +1417,7 @@ poll_mode:
if (dspi->devtype_data->trans_mode != DSPI_DMA_MODE) if (dspi->devtype_data->trans_mode != DSPI_DMA_MODE)
ctlr->ptp_sts_supported = true; ctlr->ptp_sts_supported = true;
platform_set_drvdata(pdev, ctlr); platform_set_drvdata(pdev, dspi);
ret = spi_register_controller(ctlr); ret = spi_register_controller(ctlr);
if (ret != 0) { if (ret != 0) {
@ -1437,8 +1440,7 @@ out_ctlr_put:
static int dspi_remove(struct platform_device *pdev) static int dspi_remove(struct platform_device *pdev)
{ {
struct spi_controller *ctlr = platform_get_drvdata(pdev); struct fsl_dspi *dspi = platform_get_drvdata(pdev);
struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
/* Disconnect from the SPI framework */ /* Disconnect from the SPI framework */
spi_unregister_controller(dspi->ctlr); spi_unregister_controller(dspi->ctlr);