spi: stm32: Fix use-after-free on unbind

Browse source

stm32_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: 8d559a64f0 ("spi: stm32: drop devres version of spi_register_master")

Reported-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Link: https://lore.kernel.org/r/1616052290-10887-1-git-send-email-alain.volmat@foss.st.com
Signed-off-by: Mark Brown <broonie@kernel.org>

...

This commit is contained in:

Alain Volmat 2021-03-18 08:24:50 +01:00 • committed by Mark Brown

parent 92bad4a4c7

commit 79c6246ae8

No known key found for this signature in database

GPG key ID: 24D68B725D5487D0

1 changed files with 10 additions and 14 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

24

drivers/spi/spi-stm32.c

View file