Re: [PATCH] spi: davinci: Fix use-after-free on unbind

[Peter Ujfalusi <peter.ujfalusi@xxxxxx>]

Hi Lukas,

On 09/11/2020 0.41, Lukas Wunner wrote:
> davinci_spi_remove() accesses the driver's private data after it's been
> freed with spi_master_put().
> 
> Fix by moving the spi_master_put() to the end of the function.

Thanks for spotting it,

Acked-by: Peter Ujfalusi <peter.ujfalusi@xxxxxx>

> Fixes: fe5fd2540947 ("spi: davinci: Use dma_request_chan() for requesting DMA channel")
> Signed-off-by: Lukas Wunner <lukas@xxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx> # v4.7+
> Cc: Peter Ujfalusi <peter.ujfalusi@xxxxxx>
> ---
>  drivers/spi/spi-davinci.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
> index 818f2b22875d..7453a1dbbc06 100644
> --- a/drivers/spi/spi-davinci.c
> +++ b/drivers/spi/spi-davinci.c
> @@ -1040,13 +1040,13 @@ static int davinci_spi_remove(struct platform_device *pdev)
>  	spi_bitbang_stop(&dspi->bitbang);
>  
>  	clk_disable_unprepare(dspi->clk);
> -	spi_master_put(master);
>  
>  	if (dspi->dma_rx) {
>  		dma_release_channel(dspi->dma_rx);
>  		dma_release_channel(dspi->dma_tx);
>  	}
>  
> +	spi_master_put(master);
>  	return 0;
>  }
>  
> 

- Péter

Texas Instruments Finland Oy, Porkkalankatu 22, 00180 Helsinki.
Y-tunnus/Business ID: 0615521-4. Kotipaikka/Domicile: Helsinki