spi: spi-axi: fix potential use-after-free after deregistration (4d5e0689) · Commits · 戴 / test

Take an extra reference to the controller before deregistering it to prevent use-after-free in the interrupt handler in case an interrupt fires before the line is disabled. Fixes: ("spi: Add Analog Devices AXI SPI Engine controller support") Acked-by:

Lars-Peter Clausen <lars@metafoo.de> Signed-off-by:

Johan Hovold <johan@kernel.org> Signed-off-by:

Mark Brown <broonie@kernel.org>

drivers/spi/spi-axi-spi-engine.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -553,7 +553,7 @@ err_put_master:

		static int spi_engine_remove(struct platform_device *pdev)
		{
		struct spi_master *master = platform_get_drvdata(pdev);
		struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
		struct spi_engine *spi_engine = spi_master_get_devdata(master);
		int irq = platform_get_irq(pdev, 0);

		@@ -561,6 +561,8 @@ static int spi_engine_remove(struct platform_device *pdev)

		free_irq(irq, master);

		spi_master_put(master);

		writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING);
		writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE);
		writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);

Admin message