]> git.baikalelectronics.ru Git - kernel.git/commit
spi: tegra20-slink: fix UAF in tegra_slink_remove()
authorYang Yingliang <yangyingliang@huawei.com>
Wed, 13 Jul 2022 09:40:23 +0000 (17:40 +0800)
committerMark Brown <broonie@kernel.org>
Wed, 13 Jul 2022 12:49:03 +0000 (13:49 +0100)
commit5ad39692eb8e6ed0e808f65e5b4054b03e929c2d
treeee47417ae89f3b8402d25a85a2d7a5491342749d
parent5320b274610fc1d6e609907190d6384ec2d1948b
spi: tegra20-slink: fix UAF in tegra_slink_remove()

After calling spi_unregister_master(), the refcount of master will
be decrease to 0, and it will be freed in spi_controller_release(),
the device data also will be freed, so it will lead a UAF when using
'tspi'. To fix this, get the master before unregister and put it when
finish using it.

Fixes: a86d2af2b098 ("spi: tegra20-slink: Don't use resource-managed spi_register helper")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20220713094024.1508869-1-yangyingliang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
drivers/spi/spi-tegra20-slink.c