diff options
author | Johan Hovold <johan@kernel.org> | 2017-10-30 06:35:27 -0400 |
---|---|---|
committer | Mark Brown <broonie@kernel.org> | 2017-10-31 07:15:10 -0400 |
commit | 4d5e0689dc9d5640ad46cdfbe1896b74d8df1661 (patch) | |
tree | 56d826c088398ce60c2b610284348e4df0cc5a66 | |
parent | 2bd6bf03f4c1c59381d62c61d03f6cc3fe71f66e (diff) |
spi: spi-axi: fix potential use-after-free after deregistration
Take an extra reference to the controller before deregistering it to
prevent use-after-free in the interrupt handler in case an interrupt
fires before the line is disabled.
Fixes: b1353d1c1d45 ("spi: Add Analog Devices AXI SPI Engine controller support")
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
-rw-r--r-- | drivers/spi/spi-axi-spi-engine.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c index 6ab4c7700228..68cfc351b47f 100644 --- a/drivers/spi/spi-axi-spi-engine.c +++ b/drivers/spi/spi-axi-spi-engine.c | |||
@@ -553,7 +553,7 @@ err_put_master: | |||
553 | 553 | ||
554 | static int spi_engine_remove(struct platform_device *pdev) | 554 | static int spi_engine_remove(struct platform_device *pdev) |
555 | { | 555 | { |
556 | struct spi_master *master = platform_get_drvdata(pdev); | 556 | struct spi_master *master = spi_master_get(platform_get_drvdata(pdev)); |
557 | struct spi_engine *spi_engine = spi_master_get_devdata(master); | 557 | struct spi_engine *spi_engine = spi_master_get_devdata(master); |
558 | int irq = platform_get_irq(pdev, 0); | 558 | int irq = platform_get_irq(pdev, 0); |
559 | 559 | ||
@@ -561,6 +561,8 @@ static int spi_engine_remove(struct platform_device *pdev) | |||
561 | 561 | ||
562 | free_irq(irq, master); | 562 | free_irq(irq, master); |
563 | 563 | ||
564 | spi_master_put(master); | ||
565 | |||
564 | writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING); | 566 | writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING); |
565 | writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE); | 567 | writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE); |
566 | writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET); | 568 | writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET); |