Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2be1837b authored by Lukas Wunner's avatar Lukas Wunner Committed by Greg Kroah-Hartman
Browse files

spi: bcm2835: Fix use-after-free on unbind 



[ Upstream commit e1483ac030fb4c57734289742f1c1d38dca61e22 ]

bcm2835_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: f8043872 ("spi: add driver for BCM2835")
Reported-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
Reported-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Signed-off-by: default avatarLukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.10+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.10+
Cc: Vladimir Oltean <olteanv@gmail.com>
Tested-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Acked-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/ad66e0a0ad96feb848814842ecf5b6a4539ef35c.1605121038.git.lukas@wunner.de


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5aea0d96

drivers/spi/spi-bcm2835.c

+5 −10
Original line number Diff line number Diff line
@@ -737,7 +737,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev) 
	struct resource *res;

	int err;



	master = spi_alloc_master(&pdev->dev, sizeof(*bs));

	master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));

	if (!master) {

		dev_err(&pdev->dev, "spi_alloc_master() failed\n");

		return -ENOMEM;
@@ -759,23 +759,20 @@ static int bcm2835_spi_probe(struct platform_device *pdev) 


	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);

	bs->regs = devm_ioremap_resource(&pdev->dev, res);

	if (IS_ERR(bs->regs)) {

		err = PTR_ERR(bs->regs);

		goto out_master_put;

	}

	if (IS_ERR(bs->regs))

		return PTR_ERR(bs->regs);



	bs->clk = devm_clk_get(&pdev->dev, NULL);

	if (IS_ERR(bs->clk)) {

		err = PTR_ERR(bs->clk);

		dev_err(&pdev->dev, "could not get clk: %d\n", err);

		goto out_master_put;

		return err;

	}



	bs->irq = platform_get_irq(pdev, 0);

	if (bs->irq <= 0) {

		dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);

		err = bs->irq ? bs->irq : -ENODEV;

		goto out_master_put;

		return bs->irq ? bs->irq : -ENODEV;

	}



	clk_prepare_enable(bs->clk);
@@ -803,8 +800,6 @@ static int bcm2835_spi_probe(struct platform_device *pdev) 


out_clk_disable:

	clk_disable_unprepare(bs->clk);

out_master_put:

	spi_master_put(master);

	return err;

}