lkml.org 
[lkml]   [2022]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 0270/1095] spi: tegra20-slink: fix UAF in tegra_slink_remove()
    Date
    From: Yang Yingliang <yangyingliang@huawei.com>

    [ Upstream commit 7e9984d183bb1e99e766c5c2b950ff21f7f7b6c0 ]

    After calling spi_unregister_master(), the refcount of master will
    be decrease to 0, and it will be freed in spi_controller_release(),
    the device data also will be freed, so it will lead a UAF when using
    'tspi'. To fix this, get the master before unregister and put it when
    finish using it.

    Fixes: 26c863418221 ("spi: tegra20-slink: Don't use resource-managed spi_register helper")
    Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
    Link: https://lore.kernel.org/r/20220713094024.1508869-1-yangyingliang@huawei.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/spi/spi-tegra20-slink.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
    index 80c3787deea9..c91c226be69e 100644
    --- a/drivers/spi/spi-tegra20-slink.c
    +++ b/drivers/spi/spi-tegra20-slink.c
    @@ -1137,7 +1137,7 @@ static int tegra_slink_probe(struct platform_device *pdev)

    static int tegra_slink_remove(struct platform_device *pdev)
    {
    - struct spi_master *master = platform_get_drvdata(pdev);
    + struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
    struct tegra_slink_data *tspi = spi_master_get_devdata(master);

    spi_unregister_master(master);
    @@ -1152,6 +1152,7 @@ static int tegra_slink_remove(struct platform_device *pdev)
    if (tspi->rx_dma_chan)
    tegra_slink_deinit_dma_param(tspi, true);

    + spi_master_put(master);
    return 0;
    }

    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-15 22:52    [W:3.242 / U:0.164 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site