• Michael Walle's avatar
    spi: fsl-dspi: fix NULL pointer dereference · 6e383766
    Michael Walle authored
    Since commit 530b5aff ("spi: fsl-dspi: fix use-after-free in remove
    path") this driver causes a kernel oops:
    
    [    1.891065] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000080
    [..]
    [    2.056973] Call trace:
    [    2.059425]  dspi_setup+0xc8/0x2e0
    [    2.062837]  spi_setup+0xcc/0x248
    [    2.066160]  spi_add_device+0xb4/0x198
    [    2.069918]  of_register_spi_device+0x250/0x370
    [    2.074462]  spi_register_controller+0x4f4/0x770
    [    2.079094]  dspi_probe+0x5bc/0x7b0
    [    2.082594]  platform_drv_probe+0x5c/0xb0
    [    2.086615]  really_probe+0xec/0x3c0
    [    2.090200]  driver_probe_device+0x60/0xc0
    [    2.094308]  device_driver_attach+0x7c/0x88
    [    2.098503]  __driver_attach+0x60/0xe8
    [    2.102263]  bus_for_each_dev+0x7c/0xd0
    [    2.106109]  driver_attach+0x2c/0x38
    [    2.109692]  bus_add_driver+0x194/0x1f8
    [    2.113538]  driver_register+0x6c/0x128
    [    2.117385]  __platform_driver_register+0x50/0x60
    [    2.122105]  fsl_dspi_driver_init+0x24/0x30
    [    2.126302]  do_one_initcall+0x54/0x2d0
    [    2.130149]  kernel_init_freeable+0x1ec/0x258
    [    2.134520]  kernel_init+0x1c/0x120
    [    2.138018]  ret_from_fork+0x10/0x34
    [    2.141606] Code: 97e0b11d aa0003f3 b4000680 f94006e0 (f9404000)
    [    2.147723] ---[ end trace 26cf63e6cbba33a8 ]---
    
    This is because since this commit, the allocation of the drivers private
    data is done explicitly and in this case spi_alloc_master() won't set the
    correct pointer.
    
    Also move the platform_set_drvdata() to have both next to each other.
    
    Fixes: 530b5aff ("spi: fsl-dspi: fix use-after-free in remove path")
    Signed-off-by: default avatarMichael Walle <michael@walle.cc>
    Tested-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
    Reviewed-by: default avatarKrzysztof Kozlowski <krzk@kernel.org>
    Link: https://lore.kernel.org/r/20200928085500.28254-1-michael@walle.ccSigned-off-by: default avatarMark Brown <broonie@kernel.org>
    6e383766
spi-fsl-dspi.c 36.5 KB