NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
TencentOS-kernel/drivers
History
Lukas Wunner 7b7b7fcc9d spi: bcm2835: Fix use-after-free on unbind 
commit e1483ac030fb4c57734289742f1c1d38dca61e22 upstream

bcm2835_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: f8043872e796 ("spi: add driver for BCM2835")
Reported-by: Sascha Hauer <s.hauer@pengutronix.de>
Reported-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v3.10+: 123456789abc: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v3.10+
Cc: Vladimir Oltean <olteanv@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/ad66e0a0ad96feb848814842ecf5b6a4539ef35c.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
[sudip: dev_err_probe() not yet available]
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-03-16 16:41:33 +08:00
..
accessibility
…
acpi ACPI: button: Add DMI quirk for Medion Akoya E2228T 2021-03-16 16:41:10 +08:00
amba
…
android binder: Remove bogus warning on failed same-process transaction 2021-03-16 16:38:35 +08:00
ata ata: sata_nv: Fix retrieving of active qcs 2021-03-16 16:39:39 +08:00
atm atm: nicstar: Unmap DMA on send error 2021-03-16 16:41:03 +08:00
auxdisplay
…
base PM: runtime: Resume the device earlier in __device_release_driver() 2021-03-16 16:40:31 +08:00
bcma
…
block nbd: fix a block_device refcount leak in nbd_release 2021-03-16 16:40:49 +08:00
bluetooth Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb 2021-03-16 16:39:23 +08:00
bus bus/fsl_mc: Do not rely on caller to provide non NULL mc_io 2021-03-16 16:39:49 +08:00
cdrom
…
char virtio: virtio_console: fix DMA memory allocation for rproc serial 2021-03-16 16:40:54 +08:00
clk clk: ti: clockdomain: fix static checker warning 2021-03-16 16:39:50 +08:00
clocksource clocksource/drivers/timer-gx6605s: Fixup counter reload 2021-03-16 16:37:44 +08:00
connector
…
counter counter: 104-quad-8: Add lock guards - generic interface 2021-03-16 16:27:07 +08:00
cpufreq acpi-cpufreq: Honor _PSD table setting on new AMD CPUs 2021-03-16 16:39:58 +08:00
cpuidle cpuidle: Fixup IRQ state 2021-03-16 16:35:25 +08:00
crypto chelsio/chtls: fix always leaking ctrl_skb 2021-03-16 16:40:18 +08:00
dax dax: Fix alloc_dax_region() compile warning 2021-03-16 16:36:36 +08:00
dca
…
devfreq PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out 2021-03-16 16:36:35 +08:00
dio
…
dma dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status 2021-03-16 16:40:04 +08:00
dma-buf dmabuf: fix NULL pointer dereference in dma_buf_release() 2021-03-16 16:37:40 +08:00
edac EDAC/ti: Fix handling of platform_get_irq() error 2021-03-16 16:38:22 +08:00
eisa
…
extcon extcon: ptn5150: Fix usage of atomic GPIO with sleeping GPIO chips 2021-03-16 16:39:55 +08:00
firewire
…
firmware firmware: arm_scmi: Add missing Rx size re-initialisation 2021-03-16 16:39:39 +08:00
fpga fpga: dfl: fix bug in port reset handshake 2021-03-16 16:32:23 +08:00
fsi
…
gnss gnss: sirf: fix error return code in sirf_probe() 2021-03-16 16:29:47 +08:00
gpio gpio: pcie-idio-24: Enable PEX8311 interrupts 2021-03-16 16:40:56 +08:00
gpu drm/i915: Handle max_bpc==16 2021-03-16 16:41:31 +08:00
greybus
…
hid HID: logitech-dj: Fix an error in mse_bluetooth_descriptor 2021-03-16 16:41:26 +08:00
hsi
…
hv Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected 2021-03-16 16:41:31 +08:00
hwmon hwmon: (pwm-fan) Fix RPM calculation 2021-03-16 16:41:11 +08:00
hwspinlock
…
hwtracing Revert "coresight: Make sysfs functional on topologies with per core sink" 2021-03-16 16:40:28 +08:00
i2c i2c: sh_mobile: implement atomic transfers 2021-03-16 16:40:47 +08:00
i3c i3c: master: Fix error return in cdns_i3c_master_probe() 2021-03-16 16:38:56 +08:00
ide
…
idle
…
iio iio: adc: mediatek: fix unset field 2021-03-16 16:41:28 +08:00
infiniband RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs 2021-03-16 16:41:16 +08:00
input Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER 2021-03-16 16:41:16 +08:00
interconnect
…
iommu iommu/vt-d: Avoid panic if iommu init fails in tboot system 2021-03-16 16:41:21 +08:00
ipack ipack: tpci200: fix error return code in tpci200_register() 2021-03-16 16:28:19 +08:00
irqchip irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake 2021-03-16 16:35:14 +08:00
isdn
…
leds leds: bcm6328, bcm6358: use devres LED registering function 2021-03-16 16:39:56 +08:00
lightnvm lightnvm: fix out-of-bounds write to array devices->info[] 2021-03-16 16:39:10 +08:00
macintosh macintosh/via-macii: Access autopoll_devs when inside lock 2021-03-16 16:33:39 +08:00
mailbox mailbox: avoid timer start from callback 2021-03-16 16:38:59 +08:00
mcb
…
md md/raid5: fix oops during stripe resizing 2021-03-16 16:39:54 +08:00
media media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect 2021-03-16 16:39:56 +08:00
memory memory: emif: Remove bogus debugfs error handling 2021-03-16 16:39:52 +08:00
memstick memstick: Skip allocating card when removing host 2021-03-16 16:37:44 +08:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2021-03-16 16:39:58 +08:00
mfd mfd: sprd: Add wakeup capability for PMIC IRQ 2021-03-16 16:40:48 +08:00
misc mei: protect mei_cl_mtu from null dereference 2021-03-16 16:40:54 +08:00
mmc mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers 2021-03-16 16:41:31 +08:00
mtd mtd: spi-nor: Don't copy self-pointing struct around 2021-03-16 16:40:22 +08:00
mux
…
net can: m_can: process interrupt only when not runtime suspended 2021-03-16 16:41:22 +08:00
nfc NFC: st95hf: Fix memleak in st95hf_in_send_cmd 2021-03-16 16:35:54 +08:00
ntb NTB: hw: amd: fix an issue about leak system resources 2021-03-16 16:39:10 +08:00
nubus
…
nvdimm libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr 2021-03-16 16:34:18 +08:00
nvme nvme-tcp: avoid repeated request completion 2021-03-16 16:40:45 +08:00
nvmem nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell() 2021-03-16 16:38:43 +08:00
of of/address: Fix of_node memory leak in of_dma_is_coherent 2021-03-16 16:40:51 +08:00
opp opp: Reduce the size of critical section in _opp_table_kref_release() 2021-03-16 16:40:41 +08:00
oprofile
…
parisc parisc: mask out enable and reserved bits from sba imask 2021-03-16 16:33:54 +08:00
parport
…
pci PCI: qcom: Make sure PCIe is reset before init for rev 2.1.0 2021-03-16 16:40:33 +08:00
pcmcia
…
perf drivers/perf: thunderx2_pmu: Fix memory resource error handling 2021-03-16 16:38:23 +08:00
phy phy: marvell: comphy: Convert internal SMCC firmware return codes to errno 2021-03-16 16:39:36 +08:00
pinctrl pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq 2021-03-16 16:41:09 +08:00
platform platform/x86: mlx-platform: Remove PSU EEPROM configuration 2021-03-16 16:38:46 +08:00
pnp
…
power power: supply: test_power: add missing newlines when printing parameters by sysfs 2021-03-16 16:39:49 +08:00
powercap powercap: restrict energy meter to root access 2021-03-16 16:40:32 +08:00
pps
…
ps3
…
ptp
…
pwm pwm: img: Fix null pointer access in probe 2021-03-16 16:39:01 +08:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2021-03-16 16:38:59 +08:00
ras
…
regulator regulator: workaround self-referent regulators 2021-03-16 16:41:29 +08:00
remoteproc remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load 2021-03-16 16:34:10 +08:00
reset
…
rpmsg rpmsg: glink: Use complete_all for open states 2021-03-16 16:39:50 +08:00
rtc rtc: rx8010: don't modify the global rtc ops 2021-03-16 16:40:09 +08:00
s390 s390/dasd: fix null pointer dereference for ERP requests 2021-03-16 16:41:31 +08:00
sbus
…
scsi scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() 2021-03-16 16:41:10 +08:00
sfi
…
sh
…
siox
…
slimbus slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback 2021-03-16 16:38:42 +08:00
soc soc: fsl: qbman: Fix return value on success 2021-03-16 16:39:09 +08:00
soundwire soundwire: bus: disable pm_runtime in sdw_slave_delete 2021-03-16 16:36:55 +08:00
spi spi: bcm2835: Fix use-after-free on unbind 2021-03-16 16:41:33 +08:00
spmi
…
ssb
…
staging staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids 2021-03-16 16:41:27 +08:00
target scsi: target: tcmu: Fix warning: 'page' may be used uninitialized 2021-03-16 16:38:45 +08:00
tc
…
tee
…
thermal thermal: rcar_thermal: Handle probe error gracefully 2021-03-16 16:37:03 +08:00
thunderbolt thunderbolt: Add the missed ida_simple_remove() in ring_request_msix() 2021-03-16 16:40:53 +08:00
tty tty: serial: imx: keep console clocks always on 2021-03-16 16:41:26 +08:00
uio uio: Fix use-after-free in uio_unregister_device() 2021-03-16 16:40:53 +08:00
usb xhci: hisilicon: fix refercence leak in xhci_histb_probe 2021-03-16 16:40:54 +08:00
vfio vfio/pci: Bypass IGD init in case of -ENODEV 2021-03-16 16:40:46 +08:00
vhost vringh: fix __vringh_iov() when riov and wiov are different 2021-03-16 16:40:12 +08:00
video video: fbdev: pvr2fb: initialize variables 2021-03-16 16:39:42 +08:00
virt drivers/virt/fsl_hypervisor: Fix error handling path 2021-03-16 16:38:36 +08:00
virtio virtio_ring: Avoid loop when vq is broken in virtqueue_poll 2021-03-16 16:34:34 +08:00
visorbus
…
vlynq
…
vme
…
w1 w1: mxc_w1: Fix timeout resolution problem leading to bus error 2021-03-16 16:39:58 +08:00
watchdog drivers: watchdog: rdc321x_wdt: Fix race condition bugs 2021-03-16 16:39:51 +08:00
xen xen/events: block rogue events for some time 2021-03-16 16:39:38 +08:00
zorro
…
Kconfig
…
Makefile
…