Commit 4d5e0689 authored by Johan Hovold's avatar Johan Hovold Committed by Mark Brown

spi: spi-axi: fix potential use-after-free after deregistration

Take an extra reference to the controller before deregistering it to
prevent use-after-free in the interrupt handler in case an interrupt
fires before the line is disabled.

Fixes: b1353d1c ("spi: Add Analog Devices AXI SPI Engine controller support")
Acked-by: default avatarLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 2bd6bf03
...@@ -553,7 +553,7 @@ static int spi_engine_probe(struct platform_device *pdev) ...@@ -553,7 +553,7 @@ static int spi_engine_probe(struct platform_device *pdev)
static int spi_engine_remove(struct platform_device *pdev) static int spi_engine_remove(struct platform_device *pdev)
{ {
struct spi_master *master = platform_get_drvdata(pdev); struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
struct spi_engine *spi_engine = spi_master_get_devdata(master); struct spi_engine *spi_engine = spi_master_get_devdata(master);
int irq = platform_get_irq(pdev, 0); int irq = platform_get_irq(pdev, 0);
...@@ -561,6 +561,8 @@ static int spi_engine_remove(struct platform_device *pdev) ...@@ -561,6 +561,8 @@ static int spi_engine_remove(struct platform_device *pdev)
free_irq(irq, master); free_irq(irq, master);
spi_master_put(master);
writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING); writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING);
writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE); writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE);
writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET); writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment