diff options
| author | Johan Hovold <johan@kernel.org> | 2026-04-14 15:43:15 +0200 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2026-04-20 12:39:27 +0100 |
| commit | 706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0 (patch) | |
| tree | dea81f759160611dde0e436ef5df5113af29f999 /drivers/spi | |
| parent | 0f997fdae819a8c2cc83bd4ff7d935ad76c727c9 (diff) | |
spi: mpc52xx: fix use-after-free on unbind
The state machine work is scheduled by the interrupt handler and
therefore needs to be cancelled after disabling interrupts to avoid a
potential use-after-free.
Fixes: 984836621aad ("spi: mpc52xx: Add cancel_work_sync before module remove")
Cc: stable@vger.kernel.org
Cc: Pei Xiao <xiaopei01@kylinos.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi')
| -rw-r--r-- | drivers/spi/spi-mpc52xx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/spi/spi-mpc52xx.c b/drivers/spi/spi-mpc52xx.c index 823b49f8ece2..c8c8e6bdf421 100644 --- a/drivers/spi/spi-mpc52xx.c +++ b/drivers/spi/spi-mpc52xx.c @@ -519,10 +519,11 @@ static void mpc52xx_spi_remove(struct platform_device *op) spi_unregister_controller(host); - cancel_work_sync(&ms->work); free_irq(ms->irq0, ms); free_irq(ms->irq1, ms); + cancel_work_sync(&ms->work); + for (i = 0; i < ms->gpio_cs_count; i++) gpiod_put(ms->gpio_cs[i]); |