Skip to content

Commit 6e38376

Browse files
mwallebroonie
authored andcommitted
spi: fsl-dspi: fix NULL pointer dereference
Since commit 530b5af ("spi: fsl-dspi: fix use-after-free in remove path") this driver causes a kernel oops: [ 1.891065] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080 [..] [ 2.056973] Call trace: [ 2.059425] dspi_setup+0xc8/0x2e0 [ 2.062837] spi_setup+0xcc/0x248 [ 2.066160] spi_add_device+0xb4/0x198 [ 2.069918] of_register_spi_device+0x250/0x370 [ 2.074462] spi_register_controller+0x4f4/0x770 [ 2.079094] dspi_probe+0x5bc/0x7b0 [ 2.082594] platform_drv_probe+0x5c/0xb0 [ 2.086615] really_probe+0xec/0x3c0 [ 2.090200] driver_probe_device+0x60/0xc0 [ 2.094308] device_driver_attach+0x7c/0x88 [ 2.098503] __driver_attach+0x60/0xe8 [ 2.102263] bus_for_each_dev+0x7c/0xd0 [ 2.106109] driver_attach+0x2c/0x38 [ 2.109692] bus_add_driver+0x194/0x1f8 [ 2.113538] driver_register+0x6c/0x128 [ 2.117385] __platform_driver_register+0x50/0x60 [ 2.122105] fsl_dspi_driver_init+0x24/0x30 [ 2.126302] do_one_initcall+0x54/0x2d0 [ 2.130149] kernel_init_freeable+0x1ec/0x258 [ 2.134520] kernel_init+0x1c/0x120 [ 2.138018] ret_from_fork+0x10/0x34 [ 2.141606] Code: 97e0b11d aa0003f3 b4000680 f94006e0 (f9404000) [ 2.147723] ---[ end trace 26cf63e6cbba33a8 ]--- This is because since this commit, the allocation of the drivers private data is done explicitly and in this case spi_alloc_master() won't set the correct pointer. Also move the platform_set_drvdata() to have both next to each other. Fixes: 530b5af ("spi: fsl-dspi: fix use-after-free in remove path") Signed-off-by: Michael Walle <[email protected]> Tested-by: Sascha Hauer <[email protected]> Reviewed-by: Krzysztof Kozlowski <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Mark Brown <[email protected]>
1 parent 00fb259 commit 6e38376

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

drivers/spi/spi-fsl-dspi.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1281,6 +1281,9 @@ static int dspi_probe(struct platform_device *pdev)
12811281
if (!ctlr)
12821282
return -ENOMEM;
12831283

1284+
spi_controller_set_devdata(ctlr, dspi);
1285+
platform_set_drvdata(pdev, dspi);
1286+
12841287
dspi->pdev = pdev;
12851288
dspi->ctlr = ctlr;
12861289

@@ -1417,8 +1420,6 @@ static int dspi_probe(struct platform_device *pdev)
14171420
if (dspi->devtype_data->trans_mode != DSPI_DMA_MODE)
14181421
ctlr->ptp_sts_supported = true;
14191422

1420-
platform_set_drvdata(pdev, dspi);
1421-
14221423
ret = spi_register_controller(ctlr);
14231424
if (ret != 0) {
14241425
dev_err(&pdev->dev, "Problem registering DSPI ctlr\n");

0 commit comments

Comments
 (0)