Re: [PATCH 2/4] spi: bcm2835: Fix use-after-free on unbind

[Florian Fainelli <f.fainelli@xxxxxxxxx>]

On 11/11/20 11:07 AM, Lukas Wunner wrote:
> bcm2835_spi_remove() accesses the driver's private data after calling
> spi_unregister_controller() even though that function releases the last
> reference on the spi_controller and thereby frees the private data.
> 
> Fix by switching over to the new devm_spi_alloc_master() helper which
> keeps the private data accessible until the driver has unbound.
> 
> Fixes: f8043872e796 ("spi: add driver for BCM2835")
> Reported-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
> Reported-by: Florian Fainelli <f.fainelli@xxxxxxxxx>
> Signed-off-by: Lukas Wunner <lukas@xxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx> # v3.10+: 123456789abc: spi: Introduce device-managed SPI controller allocation
> Cc: <stable@xxxxxxxxxxxxxxx> # v3.10+
> Cc: Vladimir Oltean <olteanv@xxxxxxxxx>

Tested-by: Florian Fainelli <f.fainelli@xxxxxxxxx>
Acked-by: Florian Fainelli <f.fainelli@xxxxxxxxx>
-- 
Florian