aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohan Hovold <johan@kernel.org>2017-10-30 06:35:27 -0400
committerMark Brown <broonie@kernel.org>2017-10-31 07:15:10 -0400
commit4d5e0689dc9d5640ad46cdfbe1896b74d8df1661 (patch)
tree56d826c088398ce60c2b610284348e4df0cc5a66
parent2bd6bf03f4c1c59381d62c61d03f6cc3fe71f66e (diff)
spi: spi-axi: fix potential use-after-free after deregistration
Take an extra reference to the controller before deregistering it to prevent use-after-free in the interrupt handler in case an interrupt fires before the line is disabled. Fixes: b1353d1c1d45 ("spi: Add Analog Devices AXI SPI Engine controller support") Acked-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org>
-rw-r--r--drivers/spi/spi-axi-spi-engine.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c
index 6ab4c7700228..68cfc351b47f 100644
--- a/drivers/spi/spi-axi-spi-engine.c
+++ b/drivers/spi/spi-axi-spi-engine.c
@@ -553,7 +553,7 @@ err_put_master:
553 553
554static int spi_engine_remove(struct platform_device *pdev) 554static int spi_engine_remove(struct platform_device *pdev)
555{ 555{
556 struct spi_master *master = platform_get_drvdata(pdev); 556 struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
557 struct spi_engine *spi_engine = spi_master_get_devdata(master); 557 struct spi_engine *spi_engine = spi_master_get_devdata(master);
558 int irq = platform_get_irq(pdev, 0); 558 int irq = platform_get_irq(pdev, 0);
559 559
@@ -561,6 +561,8 @@ static int spi_engine_remove(struct platform_device *pdev)
561 561
562 free_irq(irq, master); 562 free_irq(irq, master);
563 563
564 spi_master_put(master);
565
564 writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING); 566 writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING);
565 writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE); 567 writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE);
566 writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET); 568 writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);