github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

spi: atcspi200: fix use-after-free when driver unbind

Browse Source 
DMA resource is initialized after SPI controller registration. So
when driver unbind, this can trigger a use-after-free when DMA is
torn down while the controller is still alive and triggers DMA transfers.

Fixes: 34e3815ea4 ("spi: atcspi200: Add ATCSPI200 SPI controller driver")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260417-atcspi-v1-1-854831667d63@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Felix Gu 2026-04-17 00:27:54 +08:00 committed by Mark Brown
parent 254f49634e
commit 565bdf4512
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/spi/spi-atcspi200.c
View File

@ -575,12 +575,6 @@ static int atcspi_probe(struct platform_device *pdev)
if (ret)
goto free_controller;
ret = devm_spi_register_controller(&pdev->dev, host);
if (ret) {
dev_err_probe(spi->dev, ret,
"Failed to register SPI controller\n");
goto free_controller;
}
spi->use_dma = false;
if (ATCSPI_DMA_SUPPORT) {
ret = atcspi_configure_dma(spi);
@ -591,6 +585,13 @@ static int atcspi_probe(struct platform_device *pdev)
spi->use_dma = true;
}
ret = devm_spi_register_controller(&pdev->dev, host);
if (ret) {
dev_err_probe(spi->dev, ret,
"Failed to register SPI controller\n");
goto free_controller;
}
return 0;
free_controller: