releases/4.9.68/spi-spi-axi-fix-potential-use-after-free-after-deregistration.patch

   1 From foo@baz Wed Dec  6 17:39:55 CET 2017
   2 From: Johan Hovold <johan@kernel.org>
   3 Date: Mon, 30 Oct 2017 11:35:27 +0100
   4 Subject: spi: spi-axi: fix potential use-after-free after deregistration
   5
   6 From: Johan Hovold <johan@kernel.org>
   7
   8
   9 [ Upstream commit 4d5e0689dc9d5640ad46cdfbe1896b74d8df1661 ]
  10
  11 Take an extra reference to the controller before deregistering it to
  12 prevent use-after-free in the interrupt handler in case an interrupt
  13 fires before the line is disabled.
  14
  15 Fixes: b1353d1c1d45 ("spi: Add Analog Devices AXI SPI Engine controller support")
  16 Acked-by: Lars-Peter Clausen <lars@metafoo.de>
  17 Signed-off-by: Johan Hovold <johan@kernel.org>
  18 Signed-off-by: Mark Brown <broonie@kernel.org>
  19 Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21 ---
  22  drivers/spi/spi-axi-spi-engine.c |    4 +++-
  23  1 file changed, 3 insertions(+), 1 deletion(-)
  24
  25 --- a/drivers/spi/spi-axi-spi-engine.c
  26 +++ b/drivers/spi/spi-axi-spi-engine.c
  27 @@ -553,7 +553,7 @@ err_put_master:
  28
  29  static int spi_engine_remove(struct platform_device *pdev)
  30  {
  31 -       struct spi_master *master = platform_get_drvdata(pdev);
  32 +       struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
  33         struct spi_engine *spi_engine = spi_master_get_devdata(master);
  34         int irq = platform_get_irq(pdev, 0);
  35
  36 @@ -561,6 +561,8 @@ static int spi_engine_remove(struct plat
  37
  38         free_irq(irq, master);
  39
  40 +       spi_master_put(master);
  41 +
  42         writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING);
  43         writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE);
  44         writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);