2014-06-16 15:33:30

by Jürg Billeter

[permalink] [raw]
Subject: [PATCH] spi: sh-sci: fix use-after-free in sh_sci_spi_remove()

setbits() uses sp->membase.

Signed-off-by: Jürg Billeter <[email protected]>
---
drivers/spi/spi-sh-sci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
index 1f56ef6..b83dd73 100644
--- a/drivers/spi/spi-sh-sci.c
+++ b/drivers/spi/spi-sh-sci.c
@@ -175,9 +175,9 @@ static int sh_sci_spi_remove(struct platform_device *dev)
{
struct sh_sci_spi *sp = platform_get_drvdata(dev);

- iounmap(sp->membase);
- setbits(sp, PIN_INIT, 0);
spi_bitbang_stop(&sp->bitbang);
+ setbits(sp, PIN_INIT, 0);
+ iounmap(sp->membase);
spi_master_put(sp->bitbang.master);
return 0;
}
--
2.0.0


2014-06-16 16:06:20

by Geert Uytterhoeven

[permalink] [raw]
Subject: Re: [PATCH] spi: sh-sci: fix use-after-free in sh_sci_spi_remove()

On Mon, Jun 16, 2014 at 4:39 PM, Jürg Billeter <[email protected]> wrote:
> setbits() uses sp->membase.
>
> Signed-off-by: Jürg Billeter <[email protected]>

Acked-by: Geert Uytterhoeven <[email protected]>

> ---
> drivers/spi/spi-sh-sci.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/spi/spi-sh-sci.c b/drivers/spi/spi-sh-sci.c
> index 1f56ef6..b83dd73 100644
> --- a/drivers/spi/spi-sh-sci.c
> +++ b/drivers/spi/spi-sh-sci.c
> @@ -175,9 +175,9 @@ static int sh_sci_spi_remove(struct platform_device *dev)
> {
> struct sh_sci_spi *sp = platform_get_drvdata(dev);
>
> - iounmap(sp->membase);
> - setbits(sp, PIN_INIT, 0);
> spi_bitbang_stop(&sp->bitbang);
> + setbits(sp, PIN_INIT, 0);
> + iounmap(sp->membase);
> spi_master_put(sp->bitbang.master);
> return 0;
> }
> --
> 2.0.0

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

2014-06-17 14:47:31

by Mark Brown

[permalink] [raw]
Subject: Re: [PATCH] spi: sh-sci: fix use-after-free in sh_sci_spi_remove()

On Mon, Jun 16, 2014 at 04:39:29PM +0200, J?rg Billeter wrote:
> setbits() uses sp->membase.

Applied, thanks.


Attachments:
(No filename) (111.00 B)
signature.asc (819.00 B)
Digital signature
Download all attachments