From patchwork Sun Oct 29 11:56:25 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 10031379 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E59A560249 for ; Sun, 29 Oct 2017 11:57:59 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D923F28822 for ; Sun, 29 Oct 2017 11:57:59 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CD0EC28826; Sun, 29 Oct 2017 11:57:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7257328822 for ; Sun, 29 Oct 2017 11:57:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751423AbdJ2L5r (ORCPT ); Sun, 29 Oct 2017 07:57:47 -0400 Received: from mail-lf0-f66.google.com ([209.85.215.66]:55706 "EHLO mail-lf0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750915AbdJ2L5X (ORCPT ); Sun, 29 Oct 2017 07:57:23 -0400 Received: by mail-lf0-f66.google.com with SMTP id p184so11779537lfe.12; Sun, 29 Oct 2017 04:57:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=MeKxgn+eTvROw4lvHCQWfZxeWbzxfm7Aei2sdvMkygs=; b=NY8v62FKKFSAToIHLx5lgXfnQtTvi05Poy6qqxCNr0J1uY9flgKoGTmmt6FpF+wmxO 7yvMwHIexqetbhJa4S5qg16teFwmIXBHL2k/STo6EWJkps9rLQckflwz0jCURzgWYiKo Tv3XWl2RFXxxvqhP+Uu0ljLAtkBZg4taCZ6EZ5eJ+gihXha3UWOTJMuOqXBxuQp+TUG0 jdQ3NW21Ts+AEs8MdI9tD7ATyZwn7hy3NFOmUwag28h9kkQNoiRSAx6hsj8Rx5vR4cJ6 SF9FRcG2huKxx33Q58T8e6NK3nGqc50v+BheaYekvZXcNeHiBNhpmpbhSLXFluBJ4W+7 OQNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=MeKxgn+eTvROw4lvHCQWfZxeWbzxfm7Aei2sdvMkygs=; b=qVGDRvVoKzE5ED1Qz6Qhz6N7EdUVgTMQCoJK5TIU2qUuZS47igkxt7Ga4i7C+Pni+5 cwNb/vCMOs8u17pq0OErsQuUpuNYzbYecwFNHshpSbMZtmRar5980QMFCOWPIegX1TvT QbZfguWMWvd7Hlubl0kwKbOFlGiHCMsA6SjhovtDaXt8FOX6Tf5Lmiv6+AK6TzkAsVT8 onpYftDugSBqovCTFrNLjcA0rl1n+8iajUdvlJJ27Z2DgSBwyLbuEkmgzs+fkEmFjQj4 hK5m9PEv4XNprMA26T1YoK2m5n9QQ6z6gU8KB+Vw92RfSM3izfALrOBKpuHTevzfxVUF 38wQ== X-Gm-Message-State: AMCzsaUxH0m0VLmn24gThp+CTv0LXbAjuCMsaC/KbWX8JpbRz3CyPFk+ BoPyLBh2gS4oPndo1b+398ezkbbD X-Google-Smtp-Source: ABhQp+TjdJedSJ17ko6LTTIxuyTnrM6Z/Q9e+mOkuOxlbI0MD4FBWD+pogKIictjwaoBrwmZCqRFvQ== X-Received: by 10.25.206.69 with SMTP id e66mr1535126lfg.259.1509278241676; Sun, 29 Oct 2017 04:57:21 -0700 (PDT) Received: from xi.terra (c-fab8e655.07-184-6d6c6d4.cust.bredbandsbolaget.se. [85.230.184.250]) by smtp.gmail.com with ESMTPSA id c74sm2217200lfb.96.2017.10.29.04.57.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 29 Oct 2017 04:57:19 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.89) (envelope-from ) id 1e8mDO-0008RH-47; Sun, 29 Oct 2017 12:57:18 +0100 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Lars-Peter Clausen Subject: [PATCH 3/3] spi: spi-axi: take extra controller reference before deregistration Date: Sun, 29 Oct 2017 12:56:25 +0100 Message-Id: <20171029115625.32385-3-johan@kernel.org> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20171029115625.32385-1-johan@kernel.org> References: <20171029115625.32385-1-johan@kernel.org> Sender: linux-spi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-spi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Take an extra reference to the controller to avoid use-after-free in free_irq() which is called only after the controller has been deregistered and freed. Note that this is not an issue for this particular driver which does not use shared interrupts, but free_irq() could otherwise end up accessing the freed controller when CONFIG_DEBUG_SHIRQ is set. Defer controller release until free_irq() returns to prevent this from ever becoming an issue should this code be replicated in other drivers. Cc: Lars-Peter Clausen Signed-off-by: Johan Hovold Acked-by: Lars-Peter Clausen --- drivers/spi/spi-axi-spi-engine.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c index 6ab4c7700228..68cfc351b47f 100644 --- a/drivers/spi/spi-axi-spi-engine.c +++ b/drivers/spi/spi-axi-spi-engine.c @@ -553,7 +553,7 @@ static int spi_engine_probe(struct platform_device *pdev) static int spi_engine_remove(struct platform_device *pdev) { - struct spi_master *master = platform_get_drvdata(pdev); + struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); struct spi_engine *spi_engine = spi_master_get_devdata(master); int irq = platform_get_irq(pdev, 0); @@ -561,6 +561,8 @@ static int spi_engine_remove(struct platform_device *pdev) free_irq(irq, master); + spi_master_put(master); + writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING); writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE); writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);