Commit abd42781 authored by Zhenzhong Duan's avatar Zhenzhong Duan Committed by Mark Brown

spi: spidev: fix a race between spidev_release and spidev_remove

Imagine below scene, spidev is referenced after it's freed.

spidev_release()                spidev_remove()
...
                                spin_lock_irq(&spidev->spi_lock);
                                    spidev->spi = NULL;
                                spin_unlock_irq(&spidev->spi_lock);
mutex_lock(&device_list_lock);
dofree = (spidev->spi == NULL);
if (dofree)
    kfree(spidev);
mutex_unlock(&device_list_lock);
                                mutex_lock(&device_list_lock);
                                list_del(&spidev->device_entry);
                                device_destroy(spidev_class, spidev->devt);
                                clear_bit(MINOR(spidev->devt), minors);
                                if (spidev->users == 0)
                                    kfree(spidev);
                                mutex_unlock(&device_list_lock);

Fix it by resetting spidev->spi in device_list_lock's protection.
Signed-off-by: default avatarZhenzhong Duan <zhenzhong.duan@gmail.com>
Link: https://lore.kernel.org/r/20200618032125.4650-1-zhenzhong.duan@gmail.comSigned-off-by: default avatarMark Brown <broonie@kernel.org>
parent 35700e22
...@@ -787,13 +787,13 @@ static int spidev_remove(struct spi_device *spi) ...@@ -787,13 +787,13 @@ static int spidev_remove(struct spi_device *spi)
{ {
struct spidev_data *spidev = spi_get_drvdata(spi); struct spidev_data *spidev = spi_get_drvdata(spi);
/* prevent new opens */
mutex_lock(&device_list_lock);
/* make sure ops on existing fds can abort cleanly */ /* make sure ops on existing fds can abort cleanly */
spin_lock_irq(&spidev->spi_lock); spin_lock_irq(&spidev->spi_lock);
spidev->spi = NULL; spidev->spi = NULL;
spin_unlock_irq(&spidev->spi_lock); spin_unlock_irq(&spidev->spi_lock);
/* prevent new opens */
mutex_lock(&device_list_lock);
list_del(&spidev->device_entry); list_del(&spidev->device_entry);
device_destroy(spidev_class, spidev->devt); device_destroy(spidev_class, spidev->devt);
clear_bit(MINOR(spidev->devt), minors); clear_bit(MINOR(spidev->devt), minors);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment