spi: fsl-dspi: fix use-after-free in remove path (530b5aff) · Commits · 戴 / test

spi_unregister_controller() not only unregisters the controller, but also frees the controller. This will free the driver data with it, so we must not access it later dspi_remove(). Solve this by allocating the driver data separately from the SPI controller. Signed-off-by:

Sascha Hauer <s.hauer@pengutronix.de> Link: https://lore.kernel.org/r/20200923131026.20707-1-s.hauer@pengutronix.de Signed-off-by:

Mark Brown <broonie@kernel.org>

drivers/spi/spi-fsl-dspi.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -1273,11 +1273,14 @@ static int dspi_probe(struct platform_device *pdev)
		void __iomem *base;
		bool big_endian;

		ctlr = spi_alloc_master(&pdev->dev, sizeof(struct fsl_dspi));
		dspi = devm_kzalloc(&pdev->dev, sizeof(*dspi), GFP_KERNEL);
		if (!dspi)
		return -ENOMEM;

		ctlr = spi_alloc_master(&pdev->dev, 0);
		if (!ctlr)
		return -ENOMEM;

		dspi = spi_controller_get_devdata(ctlr);
		dspi->pdev = pdev;
		dspi->ctlr = ctlr;

		@@ -1414,7 +1417,7 @@ poll_mode:
		if (dspi->devtype_data->trans_mode != DSPI_DMA_MODE)
		ctlr->ptp_sts_supported = true;

		platform_set_drvdata(pdev, ctlr);
		platform_set_drvdata(pdev, dspi);

		ret = spi_register_controller(ctlr);
		if (ret != 0) {
		@@ -1437,8 +1440,7 @@ out_ctlr_put:

		static int dspi_remove(struct platform_device *pdev)
		{
		struct spi_controller *ctlr = platform_get_drvdata(pdev);
		struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
		struct fsl_dspi *dspi = platform_get_drvdata(pdev);

		/* Disconnect from the SPI framework */
		spi_unregister_controller(dspi->ctlr);

Admin message