Commit db2d81fa authored by Michael Walle's avatar Michael Walle Committed by Zeng Heng
Browse files

spi: fix use-after-free of the add_lock mutex 

mainline inclusion
from mainline-v5.16-rc2
commit 6c53b45c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RBZI
CVE: CVE-2021-47469

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6c53b45c71b4920b5e62f0ea8079a1da382b9434



--------------------------------

Commit 6098475d ("spi: Fix deadlock when adding SPI controllers on
SPI buses") introduced a per-controller mutex. But mutex_unlock() of
said lock is called after the controller is already freed:

  spi_unregister_controller(ctlr)
  -> put_device(&ctlr->dev)
    -> spi_controller_release(dev)
  -> mutex_unlock(&ctrl->add_lock)

Move the put_device() after the mutex_unlock().

Fixes: 6098475d ("spi: Fix deadlock when adding SPI controllers on SPI buses")
Signed-off-by: default avatarMichael Walle <michael@walle.cc>
Reviewed-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: default avatarLukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v5.15
Link: https://lore.kernel.org/r/20211111083713.3335171-1-michael@walle.cc


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Signed-off-by: default avatarZeng Heng <zengheng4@huawei.com>
parent 2b0e9643

drivers/spi/spi.c

+6 −6
Original line number Diff line number Diff line
@@ -2888,12 +2888,6 @@ void spi_unregister_controller(struct spi_controller *ctlr) 


	device_del(&ctlr->dev);



	/* Release the last reference on the controller if its driver

	 * has not yet been converted to devm_spi_alloc_master/slave().

	 */

	if (!ctlr->devm_allocated)

		put_device(&ctlr->dev);



	/* free bus id */

	mutex_lock(&board_lock);

	if (found == ctlr)
@@ -2902,6 +2896,12 @@ void spi_unregister_controller(struct spi_controller *ctlr) 


	if (IS_ENABLED(CONFIG_SPI_DYNAMIC))

		mutex_unlock(&ctlr->add_lock);



	/* Release the last reference on the controller if its driver

	 * has not yet been converted to devm_spi_alloc_master/slave().

	 */

	if (!ctlr->devm_allocated)

		put_device(&ctlr->dev);

}

EXPORT_SYMBOL_GPL(spi_unregister_controller);