Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ee4846b0 authored by Zhenzhong Duan's avatar Zhenzhong Duan Committed by Greg Kroah-Hartman
Browse files

spi: spidev: fix a potential use-after-free in spidev_release() 



[ Upstream commit 06096cc6c5a84ced929634b0d79376b94c65a4bd ]

If an spi device is unbounded from the driver before the release
process, there will be an NULL pointer reference when it's
referenced in spi_slave_abort().

Fix it by checking it's already freed before reference.

Signed-off-by: default avatarZhenzhong Duan <zhenzhong.duan@gmail.com>
Link: https://lore.kernel.org/r/20200618032125.4650-2-zhenzhong.duan@gmail.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 3c93eb6f

drivers/spi/spidev.c

+10 −10
Original line number Diff line number Diff line
@@ -607,15 +607,20 @@ static int spidev_open(struct inode *inode, struct file *filp) 
static int spidev_release(struct inode *inode, struct file *filp)

{

	struct spidev_data	*spidev;

	int			dofree;



	mutex_lock(&device_list_lock);

	spidev = filp->private_data;

	filp->private_data = NULL;



	spin_lock_irq(&spidev->spi_lock);

	/* ... after we unbound from the underlying device? */

	dofree = (spidev->spi == NULL);

	spin_unlock_irq(&spidev->spi_lock);



	/* last close? */

	spidev->users--;

	if (!spidev->users) {

		int		dofree;



		kfree(spidev->tx_buffer);

		spidev->tx_buffer = NULL;
@@ -623,18 +628,13 @@ static int spidev_release(struct inode *inode, struct file *filp) 
		kfree(spidev->rx_buffer);

		spidev->rx_buffer = NULL;



		spin_lock_irq(&spidev->spi_lock);

		if (spidev->spi)

			spidev->speed_hz = spidev->spi->max_speed_hz;



		/* ... after we unbound from the underlying device? */

		dofree = (spidev->spi == NULL);

		spin_unlock_irq(&spidev->spi_lock);



		if (dofree)

			kfree(spidev);

		else

			spidev->speed_hz = spidev->spi->max_speed_hz;

	}

#ifdef CONFIG_SPI_SLAVE

	if (!dofree)

		spi_slave_abort(spidev->spi);

#endif

	mutex_unlock(&device_list_lock);