| Message ID | 20200922093228.24917-4-s.hauer@pengutronix.de |
|---|---|
| State | New |
| Headers | show |
| Series | [1/6] spi: fsl-dspi: Use devm_spi_register_controller() | expand |
On Tue, 2020-09-22 at 11:32 +0200, Sascha Hauer wrote: > Calling spi_unregister_controller() during driver remove results in > freeing the SPI controller and the associated driver data. Using it > later in bcm2835_spi_remove() is a use-after-free bug. Register the > controller with devm_spi_register_controller() instead which makes > calling spi_unregister_controller() unnecessary. > > Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> > --- Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de> > drivers/spi/spi-bcm2835.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c > index c45d76c848c8..d22103f7beeb 100644 > --- a/drivers/spi/spi-bcm2835.c > +++ b/drivers/spi/spi-bcm2835.c > @@ -1350,7 +1350,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev) > goto out_dma_release; > } > > - err = spi_register_controller(ctlr); > + err = devm_spi_register_controller(&pdev->dev, ctlr); > if (err) { > dev_err(&pdev->dev, "could not register SPI controller: %d\n", > err); > @@ -1377,8 +1377,6 @@ static int bcm2835_spi_remove(struct platform_device *pdev) > > bcm2835_debugfs_remove(bs); > > - spi_unregister_controller(ctlr); > - > bcm2835_dma_release(ctlr, bs); > > /* Clear FIFOs, and disable the HW block */
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c index c45d76c848c8..d22103f7beeb 100644 --- a/drivers/spi/spi-bcm2835.c +++ b/drivers/spi/spi-bcm2835.c @@ -1350,7 +1350,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev) goto out_dma_release; } - err = spi_register_controller(ctlr); + err = devm_spi_register_controller(&pdev->dev, ctlr); if (err) { dev_err(&pdev->dev, "could not register SPI controller: %d\n", err); @@ -1377,8 +1377,6 @@ static int bcm2835_spi_remove(struct platform_device *pdev) bcm2835_debugfs_remove(bs); - spi_unregister_controller(ctlr); - bcm2835_dma_release(ctlr, bs); /* Clear FIFOs, and disable the HW block */
Calling spi_unregister_controller() during driver remove results in freeing the SPI controller and the associated driver data. Using it later in bcm2835_spi_remove() is a use-after-free bug. Register the controller with devm_spi_register_controller() instead which makes calling spi_unregister_controller() unnecessary. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> --- drivers/spi/spi-bcm2835.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)