| From 770b03c2ca4aa44d226cf248f86aa23e546147d0 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Sun, 29 Oct 2017 13:01:33 +0100 |
| Subject: staging: greybus: spilib: fix use-after-free after deregistration |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| commit 770b03c2ca4aa44d226cf248f86aa23e546147d0 upstream. |
| |
| Remove erroneous spi_master_put() after controller deregistration which |
| would access the already freed spi controller. |
| |
| Note that spi_unregister_master() drops our only controller reference. |
| |
| Fixes: ba3e67001b42 ("greybus: SPI: convert to a gpbridge driver") |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com> |
| Acked-by: Viresh Kumar <viresh.kumar@linaro.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/staging/greybus/spilib.c | 8 +++++--- |
| 1 file changed, 5 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/staging/greybus/spilib.c |
| +++ b/drivers/staging/greybus/spilib.c |
| @@ -544,12 +544,15 @@ int gb_spilib_master_init(struct gb_conn |
| |
| return 0; |
| |
| -exit_spi_unregister: |
| - spi_unregister_master(master); |
| exit_spi_put: |
| spi_master_put(master); |
| |
| return ret; |
| + |
| +exit_spi_unregister: |
| + spi_unregister_master(master); |
| + |
| + return ret; |
| } |
| EXPORT_SYMBOL_GPL(gb_spilib_master_init); |
| |
| @@ -558,7 +561,6 @@ void gb_spilib_master_exit(struct gb_con |
| struct spi_master *master = gb_connection_get_data(connection); |
| |
| spi_unregister_master(master); |
| - spi_master_put(master); |
| } |
| EXPORT_SYMBOL_GPL(gb_spilib_master_exit); |
| |