From: Lukas Wunner <lukas@wunner.de>
To: Michael Walle <michael@walle.cc>
Cc: linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org,
"Mark Brown" <broonie@kernel.org>,
"Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>,
"Vladimir Oltean" <olteanv@gmail.com>,
"Andy Shevchenko" <andy.shevchenko@gmail.com>
Subject: Re: [RFC PATCH] spi: fix use-after-free of the add_lock mutex
Date: Thu, 11 Nov 2021 06:19:23 +0100 [thread overview]
Message-ID: <20211111051923.GA19356@wunner.de> (raw)
In-Reply-To: <20211110160836.3304104-1-michael@walle.cc>
On Wed, Nov 10, 2021 at 05:08:36PM +0100, Michael Walle wrote:
> Commit 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on
> SPI buses") introduced a per-controller mutex. But mutex_unlock() of
> said lock is called after the controller is already freed:
>
> spi_unregister_controller(ctlr)
> -> put_device(&ctlr->dev)
> -> spi_controller_release(dev)
> mutex_unlock(&ctrl->add_lock)
>
> Move the put_device() after the mutex_unlock().
>
> Fixes: 6098475d4cb4 ("spi: Fix deadlock when adding SPI controllers on SPI buses")
> Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v5.15
prev parent reply other threads:[~2021-11-11 5:19 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-10 16:08 [RFC PATCH] spi: fix use-after-free of the add_lock mutex Michael Walle
2021-11-10 16:27 ` Mark Brown
2021-11-10 16:30 ` Michael Walle
2021-11-10 16:39 ` Mark Brown
2021-11-10 16:49 ` Andy Shevchenko
2021-11-10 17:28 ` Uwe Kleine-König
2021-11-11 5:19 ` Lukas Wunner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211111051923.GA19356@wunner.de \
--to=lukas@wunner.de \
--cc=andy.shevchenko@gmail.com \
--cc=broonie@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=michael@walle.cc \
--cc=olteanv@gmail.com \
--cc=u.kleine-koenig@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.