• L
    spi: bcm-qspi: Fix use-after-free on unbind · 63c5395b
    Lukas Wunner 提交于
    bcm_qspi_remove() calls spi_unregister_master() even though
    bcm_qspi_probe() calls devm_spi_register_master().  The spi_master is
    therefore unregistered and freed twice on unbind.
    
    Moreover, since commit 0392727c ("spi: bcm-qspi: Handle clock probe
    deferral"), bcm_qspi_probe() leaks the spi_master allocation if the call
    to devm_clk_get_optional() fails.
    
    Fix by switching over to the new devm_spi_alloc_master() helper which
    keeps the private data accessible until the driver has unbound and also
    avoids the spi_master leak on probe.
    
    While at it, fix an ordering issue in bcm_qspi_remove() wherein
    spi_unregister_master() is called after uninitializing the hardware,
    disabling the clock and freeing an IRQ data structure.  The correct
    order is to call spi_unregister_master() *before* those teardown steps
    because bus accesses may still be ongoing until that function returns.
    
    Fixes: fa236a7e ("spi: bcm-qspi: Add Broadcom MSPI driver")
    Signed-off-by: NLukas Wunner <lukas@wunner.de>
    Cc: <stable@vger.kernel.org> # v4.9+: 123456789abc: spi: Introduce device-managed SPI controller allocation
    Cc: <stable@vger.kernel.org> # v4.9+
    Cc: Kamal Dasu <kdasu.kdev@gmail.com>
    Acked-by: NFlorian Fainelli <f.fainelli@gmail.com>
    Tested-by: NFlorian Fainelli <f.fainelli@gmail.com>
    Link: https://lore.kernel.org/r/5e31a9a59fd1c0d0b795b2fe219f25e5ee855f9d.1605121038.git.lukas@wunner.deSigned-off-by: NMark Brown <broonie@kernel.org>
    63c5395b
spi-bcm-qspi.c 38.4 KB