From patchwork Tue Oct 31 11:22:21 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Brown X-Patchwork-Id: 10034199 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C3C0A60291 for ; Tue, 31 Oct 2017 11:22:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B1DF125F3E for ; Tue, 31 Oct 2017 11:22:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A6CD928A51; Tue, 31 Oct 2017 11:22:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5BC9E260CD for ; Tue, 31 Oct 2017 11:22:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752434AbdJaLW0 (ORCPT ); Tue, 31 Oct 2017 07:22:26 -0400 Received: from heliosphere.sirena.org.uk ([172.104.155.198]:49312 "EHLO heliosphere.sirena.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752191AbdJaLWY (ORCPT ); Tue, 31 Oct 2017 07:22:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sirena.org.uk; s=20170815-heliosphere; h=Date:Message-Id:In-Reply-To: Subject:Cc:To:From:Sender:Reply-To:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:References: List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner: List-Archive; bh=bdLWlPq/g2yabyH/0a0pYVSSw3sMqJ3uLS/quW1cEBk=; b=DhtCf7u5LAQJ wp+wif4mM/eLNqFiXNr8hf1Nqk3qfdRbQN9gnU2WTCwVUPddXftNUEnNWguSFRCYj65SXWMLW01HU yT3aji5GuxKSepbSsLV/geycHylYK2PLv1dRlz7EzZv1tlQhHNJ2Y05rGuyeGGGLj9w9giP7YweT6 8fLdI=; Received: from debutante.sirena.org.uk ([2001:470:1f1d:6b5::3] helo=debutante) by heliosphere.sirena.org.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1e9Ucf-00016Y-SQ; Tue, 31 Oct 2017 11:22:21 +0000 Received: from broonie by debutante with local (Exim 4.89) (envelope-from ) id 1e9Ucf-00031c-Fh; Tue, 31 Oct 2017 11:22:21 +0000 From: Mark Brown To: Johan Hovold Cc: Mark Brown , stable , Mark Brown , linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, stable , Suniel Mahesh , Karthik Tummala , linux-spi@vger.kernel.org Subject: Applied "spi: fix use-after-free at controller deregistration" to the spi tree In-Reply-To: <20171029115625.32385-1-johan@kernel.org> Message-Id: Date: Tue, 31 Oct 2017 11:22:21 +0000 Sender: linux-spi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-spi@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The patch spi: fix use-after-free at controller deregistration has been applied to the spi tree at git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git All being well this means that it will be integrated into the linux-next tree (usually sometime in the next 24 hours) and sent to Linus during the next merge window (or sooner if it is a bug fix), however if problems are discovered then the patch may be dropped or reverted. You may get further e-mails resulting from automated or manual testing and review of the tree, please engage with people reporting problems and send followup patches addressing any issues that are reported if needed. If any updates are required or you are submitting further changes they should be sent as incremental updates against current git, existing patches will not be replaced. Please add any relevant lists and maintainers to the CCs when replying to this mail. Thanks, Mark From 67f7b2781fafcc0f52464880154b320fea1ae982 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Mon, 30 Oct 2017 11:35:25 +0100 Subject: [PATCH] spi: fix use-after-free at controller deregistration The controller is typically freed as part of device_unregister() so store the bus id before deregistration to avoid use-after-free when the id is later released. Fixes: 9b61e302210e ("spi: Pick spi bus number from Linux idr or spi alias") Signed-off-by: Johan Hovold Signed-off-by: Mark Brown Cc: stable --- drivers/spi/spi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 6e65524cbfd9..759c9725495a 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -2240,11 +2240,12 @@ static int __unregister(struct device *dev, void *null) void spi_unregister_controller(struct spi_controller *ctlr) { struct spi_controller *found; + int id = ctlr->bus_num; int dummy; /* First make sure that this controller was ever added */ mutex_lock(&board_lock); - found = idr_find(&spi_master_idr, ctlr->bus_num); + found = idr_find(&spi_master_idr, id); mutex_unlock(&board_lock); if (found != ctlr) { dev_dbg(&ctlr->dev, @@ -2264,7 +2265,7 @@ void spi_unregister_controller(struct spi_controller *ctlr) device_unregister(&ctlr->dev); /* free bus id */ mutex_lock(&board_lock); - idr_remove(&spi_master_idr, ctlr->bus_num); + idr_remove(&spi_master_idr, id); mutex_unlock(&board_lock); } EXPORT_SYMBOL_GPL(spi_unregister_controller);