summaryrefslogtreecommitdiff
path: root/drivers/spi
diff options
context:
space:
mode:
authorZhenzhong Duan <zhenzhong.duan@gmail.com>2020-06-18 11:21:24 +0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-07-22 09:10:01 +0200
commitd8c4753285ae9740a48c9d81027395ef2f48b346 (patch)
tree46eb016c0fc5df7c9680ec559f8e4609b231da8d /drivers/spi
parent8977f55e9c0824fa784f742e40c0c72d40120c9d (diff)
spi: spidev: fix a race between spidev_release and spidev_remove
[ Upstream commit abd42781c3d2155868821f1b947ae45bbc33330d ] Imagine below scene, spidev is referenced after it's freed. spidev_release() spidev_remove() ... spin_lock_irq(&spidev->spi_lock); spidev->spi = NULL; spin_unlock_irq(&spidev->spi_lock); mutex_lock(&device_list_lock); dofree = (spidev->spi == NULL); if (dofree) kfree(spidev); mutex_unlock(&device_list_lock); mutex_lock(&device_list_lock); list_del(&spidev->device_entry); device_destroy(spidev_class, spidev->devt); clear_bit(MINOR(spidev->devt), minors); if (spidev->users == 0) kfree(spidev); mutex_unlock(&device_list_lock); Fix it by resetting spidev->spi in device_list_lock's protection. Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com> Link: https://lore.kernel.org/r/20200618032125.4650-1-zhenzhong.duan@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/spi')
-rw-r--r--drivers/spi/spidev.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 3709088d4d24..80beb8406f20 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -769,13 +769,13 @@ static int spidev_remove(struct spi_device *spi)
{
struct spidev_data *spidev = spi_get_drvdata(spi);
+ /* prevent new opens */
+ mutex_lock(&device_list_lock);
/* make sure ops on existing fds can abort cleanly */
spin_lock_irq(&spidev->spi_lock);
spidev->spi = NULL;
spin_unlock_irq(&spidev->spi_lock);
- /* prevent new opens */
- mutex_lock(&device_list_lock);
list_del(&spidev->device_entry);
device_destroy(spidev_class, spidev->devt);
clear_bit(MINOR(spidev->devt), minors);