On Tue, 2020-09-22 at 11:32 +0200, Sascha Hauer wrote:
> Calling spi_unregister_controller() during driver remove results in
> freeing the SPI controller and the associated driver data. Using it
> later in bcm2835_spi_remove() is a use-after-free bug. Register the
> controller with devm_spi_register_controller() instead which makes
> calling spi_unregister_controller() unnecessary.
>
> Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
> ---
Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@xxxxxxx>
> drivers/spi/spi-bcm2835.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
> index c45d76c848c8..d22103f7beeb 100644
> --- a/drivers/spi/spi-bcm2835.c
> +++ b/drivers/spi/spi-bcm2835.c
> @@ -1350,7 +1350,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
> goto out_dma_release;
> }
>
> - err = spi_register_controller(ctlr);
> + err = devm_spi_register_controller(&pdev->dev, ctlr);
> if (err) {
> dev_err(&pdev->dev, "could not register SPI controller: %d\n",
> err);
> @@ -1377,8 +1377,6 @@ static int bcm2835_spi_remove(struct platform_device *pdev)
>
> bcm2835_debugfs_remove(bs);
>
> - spi_unregister_controller(ctlr);
> -
> bcm2835_dma_release(ctlr, bs);
>
> /* Clear FIFOs, and disable the HW block */
Attachment:
signature.asc
Description: This is a digitally signed message part
