From: Sasha Levin <sashal@kernel.org>
To: Lukas Wunner <lukas@wunner.de>
Cc: Nathan Chancellor <natechancellor@gmail.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.com>,
Mark Brown <broonie@kernel.org>,
Sudip Mukherjee <sudipm.mukherjee@gmail.com>,
stable@vger.kernel.org
Subject: Re: [PATCH 4.19-stable 4/5] spi: bcm2835aux: Fix use-after-free on unbind
Date: Tue, 8 Dec 2020 08:47:39 -0500 [thread overview]
Message-ID: <20201208134739.GJ643756@sasha-vm> (raw)
In-Reply-To: <20201208073241.GA29998@wunner.de>
On Tue, Dec 08, 2020 at 08:32:41AM +0100, Lukas Wunner wrote:
>On Mon, Dec 07, 2020 at 05:49:01PM -0700, Nathan Chancellor wrote:
>> On Sun, Dec 06, 2020 at 01:31:03PM +0100, Lukas Wunner wrote:
>> > [ Upstream commit e13ee6cc4781edaf8c7321bee19217e3702ed481 ]
>> >
>> > bcm2835aux_spi_remove() accesses the driver's private data after calling
>> > spi_unregister_master() even though that function releases the last
>> > reference on the spi_master and thereby frees the private data.
>> >
>> > Fix by switching over to the new devm_spi_alloc_master() helper which
>> > keeps the private data accessible until the driver has unbound.
>> >
>> > Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
>> > Signed-off-by: Lukas Wunner <lukas@wunner.de>
>> > Cc: <stable@vger.kernel.org> # v4.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
>> > Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
>> > Cc: <stable@vger.kernel.org> # v4.4+
>> > Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
>> > Signed-off-by: Mark Brown <broonie@kernel.org>
>>
>> Please ensure that commit d853b3406903 ("spi: bcm2835aux: Restore err
>> assignment in bcm2835aux_spi_probe") is picked up with this patch in all
>> of the stable trees that it is applied to.
>
>That shouldn't be necessary as I've made sure that the backports to
>4.19 and earlier do not exhibit the issue fixed by d853b3406903.
>
>However, nobody is perfect, so if I've missed anything, please let
>me know.
Could we instead have the backports exhibit the issue (like they did
upstream) and then take d853b3406903 on top?
--
Thanks,
Sasha
next prev parent reply other threads:[~2020-12-08 13:48 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-06 12:31 [PATCH 4.19-stable 1/5] spi: Introduce device-managed SPI controller allocation Lukas Wunner
2020-12-06 12:31 ` [PATCH 4.19-stable 2/5] spi: bcm-qspi: Fix use-after-free on unbind Lukas Wunner
2020-12-06 12:31 ` [PATCH 4.19-stable 3/5] spi: bcm2835: " Lukas Wunner
2020-12-06 12:31 ` [PATCH 4.19-stable 4/5] spi: bcm2835aux: " Lukas Wunner
2020-12-08 0:49 ` Nathan Chancellor
2020-12-08 7:32 ` Lukas Wunner
2020-12-08 13:47 ` Sasha Levin [this message]
2020-12-08 17:11 ` Lukas Wunner
2020-12-08 20:28 ` Nathan Chancellor
2020-12-08 21:17 ` Sasha Levin
2020-12-09 8:37 ` Lukas Wunner
2020-12-09 9:36 ` Greg KH
2020-12-09 9:38 ` Lukas Wunner
2020-12-09 9:44 ` Greg KH
2020-12-10 7:01 ` Lukas Wunner
2020-12-10 12:45 ` Greg KH
2020-12-10 16:13 ` Lukas Wunner
2020-12-10 19:24 ` Lukas Wunner
2020-12-06 12:31 ` [PATCH 4.19-stable 5/5] spi: bcm2835: Release the DMA channel if probe fails after dma_init Lukas Wunner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201208134739.GJ643756@sasha-vm \
--to=sashal@kernel.org \
--cc=broonie@kernel.org \
--cc=gregkh@linuxfoundation.com \
--cc=lukas@wunner.de \
--cc=natechancellor@gmail.com \
--cc=stable@vger.kernel.org \
--cc=sudipm.mukherjee@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).