From patchwork Mon Oct 30 10:35:27 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 10032307 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0EAA06039A for ; Mon, 30 Oct 2017 10:36:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0FD4F287A7 for ; Mon, 30 Oct 2017 10:36:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 049C428818; Mon, 30 Oct 2017 10:36:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 84683287A7 for ; Mon, 30 Oct 2017 10:36:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752870AbdJ3Kfq (ORCPT ); Mon, 30 Oct 2017 06:35:46 -0400 Received: from mail-lf0-f68.google.com ([209.85.215.68]:45661 "EHLO mail-lf0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752062AbdJ3Kfo (ORCPT ); Mon, 30 Oct 2017 06:35:44 -0400 Received: by mail-lf0-f68.google.com with SMTP id n69so14354332lfn.2; Mon, 30 Oct 2017 03:35:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id:in-reply-to:references; bh=NhUq868fyd/KYXk0FTMCAz5nHQF8ADIkMhcRlTEaEr0=; b=hA2DwKFdAhwPI4CFhKm7Je2lb3OImnBoxaLyCxnMmZWMqFJ27athFCqpZd866QnVL1 wC2Zj7yY+qyC6d/R6Mv06nMxv59XZQB3zzl1txEwZMVP/8ctNzqSAoKZn0uwA17ev17A exZpUuNltCN2T3mjmcWrtcc0VtCGU85NfdCw+qtCkyZjY8Kdqx0JvI4IH/apNceTjQ0I p8I7x8hZjwaqfLdGPD/EibHjRVyGp5ApY0rHWFmPDBd/6IUyc4pzjKW3QYWS3EeeEw9v 53gymND7krxBte7Ayxi2xDTrJr8jMz6qm4W02AlRDMaHDWdaRJYMwuvdub8CygpLLc4F e0Rg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id :in-reply-to:references; bh=NhUq868fyd/KYXk0FTMCAz5nHQF8ADIkMhcRlTEaEr0=; b=dx1pkvbIFqU9lih7LGarZVGDglmbHDMHYt/eTsT5VKgB34cD0vldLjviTNviGM8sv7 rTIv4fLC0RSu3UsL2IxNQ+o19bLQWm9YxVkSjsaceMj7tifMb6zUgN35ARAuTmI2ESG+ LW80Dy0171xU9+s121LUlIggnvTodse9n3xCvb+5pzQgmwdgRtaauo8xpkcM+FVH+zGG H3ZNMRegjefiDN6w2XBHeo/0CMPLO7yXxA2+liTiYDQy2yk97cDVpoXHc3p/JlAWeX6u ycwHq80SXFNQtk2X9oeem8QLYnkwr0z0qHGasMUo6vnT3HhPE8LOEFvd+9QyXbiyp4h6 d9ig== X-Gm-Message-State: AMCzsaUMDGUB16DwEYi0ERs065h88Px7DvsRHc+rHYs3J90PlOKAHCdi 0Ve83NTMGXF3Zqyg7WgjQfI= X-Google-Smtp-Source: ABhQp+TlM1XYE/ZJ0iBI1X5LH78cHV/s9QYlgSKSc2S4F+AHIvZNC4USLsKn+bw1K8Z79V6c0rBtVw== X-Received: by 10.25.142.13 with SMTP id q13mr2673061lfd.217.1509359743069; Mon, 30 Oct 2017 03:35:43 -0700 (PDT) Received: from xi.terra (c-fab8e655.07-184-6d6c6d4.cust.bredbandsbolaget.se. [85.230.184.250]) by smtp.gmail.com with ESMTPSA id r84sm3351600ljb.28.2017.10.30.03.35.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 30 Oct 2017 03:35:42 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.89) (envelope-from ) id 1e97Px-0003cA-EZ; Mon, 30 Oct 2017 11:35:41 +0100 From: Johan Hovold To: Mark Brown Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Lars-Peter Clausen , Johan Hovold Subject: [PATCH v2 3/3] spi: spi-axi: fix potential use-after-free after deregistration Date: Mon, 30 Oct 2017 11:35:27 +0100 Message-Id: <20171030103527.13535-3-johan@kernel.org> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20171030103527.13535-1-johan@kernel.org> References: <20171030103527.13535-1-johan@kernel.org> Sender: linux-spi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-spi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Take an extra reference to the controller before deregistering it to prevent use-after-free in the interrupt handler in case an interrupt fires before the line is disabled. Fixes: b1353d1c1d45 ("spi: Add Analog Devices AXI SPI Engine controller support") Acked-by: Lars-Peter Clausen Signed-off-by: Johan Hovold --- v2 - Add Fixes tag and update commit message to reflect that this is a potential issue also for this driver (and not just for drivers using shared interrupts) as noted by Lars-Peter. drivers/spi/spi-axi-spi-engine.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c index 6ab4c7700228..68cfc351b47f 100644 --- a/drivers/spi/spi-axi-spi-engine.c +++ b/drivers/spi/spi-axi-spi-engine.c @@ -553,7 +553,7 @@ static int spi_engine_probe(struct platform_device *pdev) static int spi_engine_remove(struct platform_device *pdev) { - struct spi_master *master = platform_get_drvdata(pdev); + struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); struct spi_engine *spi_engine = spi_master_get_devdata(master); int irq = platform_get_irq(pdev, 0); @@ -561,6 +561,8 @@ static int spi_engine_remove(struct platform_device *pdev) free_irq(irq, master); + spi_master_put(master); + writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING); writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE); writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);