Skip to content
Unverified Commit 7e9984d1 authored by Yang Yingliang's avatar Yang Yingliang Committed by Mark Brown
Browse files

spi: tegra20-slink: fix UAF in tegra_slink_remove()



After calling spi_unregister_master(), the refcount of master will
be decrease to 0, and it will be freed in spi_controller_release(),
the device data also will be freed, so it will lead a UAF when using
'tspi'. To fix this, get the master before unregister and put it when
finish using it.

Fixes: 26c86341 ("spi: tegra20-slink: Don't use resource-managed spi_register helper")
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20220713094024.1508869-1-yangyingliang@huawei.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 43cc5a0a
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment