From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15CDB242D70; Tue, 24 Mar 2026 08:23:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774340631; cv=none; b=EoW7aiYFexs6p/u7WVT1lQVThbuWPd5oKEvZo4FCREeTdMWCi+jwlBOgDyTjIF29aWmJOsF6Y+15skZPGXmrq1KaiUv5BK973DZnYYtRbSvQfguLtia+N6yjkzPvwIruyEFUazc2nYXVhFmJCzA/Ti4z9xsMsHoZa8F0uEJnbDs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774340631; c=relaxed/simple; bh=RvljTYU5d8WDlmSw0H+HgYtGCn3oPYpDa9eMKvKBYvE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=M04SoCuNyurLz6Pb2O0yW6s7pafdHfmdvD/BqY8CanTf2P5KqwwjX0pM3sxtrwqW0llvp8b2w6FdoQi7QhWcSilaHDocoEJD7BPBl+AoXYRtypDSBsDAmQ5Q6LZ4jZnMqDFiGmSIn1WiAjig9Xam+0tndrJDKTbgbyKB6YvjE8E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=qH/R0Lrw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="qH/R0Lrw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8022EC19424; Tue, 24 Mar 2026 08:23:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774340630; bh=RvljTYU5d8WDlmSw0H+HgYtGCn3oPYpDa9eMKvKBYvE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qH/R0Lrw0QYesJMokvLgB0dl0J7gfN22JUBVDPwKRaIvqsrl2sM8tv54Wj3Nby3K6 q5dlU2fAxDIbKPwr7jP/wGLJ2vtCufZZ2W/2HA3LR8OXOuNygyEuZrx75L8pVWVhd9 fjuQ3MBcpJBxsly7PYZ4jae8Gtxjkv7NE4mI/t4zlTAKnUjj4Zl/CUadUNF6DhUGE6 ZOpGz/OPdbl5B2Eg6CajteZG0Q+5JjDsif/VmyJhcvuOV4cJRJyRZJtOuGwf9l7hmu go4kUgF7Ue2vlpQVewAYJcvKwzjM+5Lw3jMNAS4tSv8x+cgU8MTAGiFmE5Na/H5dGl N9joSy4zNN7Bg== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w4x3E-00000003mQC-1IMP; Tue, 24 Mar 2026 09:23:48 +0100 From: Johan Hovold To: Mark Brown Cc: Frank Li , Sascha Hauer , Heiko Stuebner , Laxman Dewangan , Marc Kleine-Budde , linux-spi@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v2 1/5] spi: imx: fix use-after-free on unbind Date: Tue, 24 Mar 2026 09:23:22 +0100 Message-ID: <20260324082326.901043-2-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260324082326.901043-1-johan@kernel.org> References: <20260324082326.901043-1-johan@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The SPI subsystem frees the controller and any subsystem allocated driver data as part of deregistration (unless the allocation is device managed). Take another reference before deregistering the controller so that the driver data is not freed until the driver is done with it. Fixes: 307c897db762 ("spi: spi-imx: replace struct spi_imx_data::bitbang by pointer to struct spi_controller") Cc: stable@vger.kernel.org # 5.19 Acked-by: Marc Kleine-Budde Signed-off-by: Johan Hovold --- drivers/spi/spi-imx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index 64c6c09e1e7b..a8d90c86a8a1 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -2401,6 +2401,8 @@ static void spi_imx_remove(struct platform_device *pdev) struct spi_imx_data *spi_imx = spi_controller_get_devdata(controller); int ret; + spi_controller_get(controller); + spi_unregister_controller(controller); ret = pm_runtime_get_sync(spi_imx->dev); @@ -2414,6 +2416,8 @@ static void spi_imx_remove(struct platform_device *pdev) pm_runtime_disable(spi_imx->dev); spi_imx_sdma_exit(spi_imx); + + spi_controller_put(controller); } static int spi_imx_runtime_resume(struct device *dev) -- 2.52.0