Skip to contentSkip to conversation

patch "staging: greybus: spilib: fix use-after-free after deregistration" added to staging-next

PATCH [email protected] 1 participant 1 message Nov 2, 2017

Subsystems (5)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

staging: greybus: spilib: fix use-after-free after deregistration

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-next branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will also be merged in the next major kernel release during the merge window.

If you have any questions about this process, please let me know.

Quoted 1 line

From 770b03c2ca4aa44d226cf248f86aa23e546147d0 Mon Sep 17 00:00:00 2001

From: Johan Hovold <[email protected]>
Date: Sun, 29 Oct 2017 13:01:33 +0100
Subject: staging: greybus: spilib: fix use-after-free after deregistration

Remove erroneous spi_master_put() after controller deregistration which would access the already freed spi controller.

Note that spi_unregister_master() drops our only controller reference.

Fixes ba3e67001b42 ("greybus: SPI: convert to a gpbridge driver")
Cc stable <[email protected]> # 4.9
---
 drivers/staging/greybus/spilib.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/staging/greybus/spilib.c +5 -3
index e97b19148497..1e7321a1404c 100644
@@ -544,11 +544,14 @@ int gb_spilib_master_init(struct gb_connection *connection, struct device *dev,
 
 	return 0;
 
-exit_spi_unregister:
-	spi_unregister_master(master);
 exit_spi_put:
 	spi_master_put(master);
 
+	return ret;
+
+exit_spi_unregister:
+	spi_unregister_master(master);
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(gb_spilib_master_init);
@@ -558,7 +561,6 @@ void gb_spilib_master_exit(struct gb_connection *connection)
 	struct spi_master *master = gb_connection_get_data(connection);
 
 	spi_unregister_master(master);
-	spi_master_put(master);
 }
 EXPORT_SYMBOL_GPL(gb_spilib_master_exit);
 
Signature · 1 line
2.15.0