6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao xiaopei01@kylinos.cn
[ Upstream commit 984836621aad98802d92c4a3047114cf518074c8 ]
If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug.
Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xx_spi_remove.
Fixes: ca632f556697 ("spi: reorganize drivers") Signed-off-by: Pei Xiao xiaopei01@kylinos.cn Link: https://patch.msgid.link/1f16f8ae0e50ca9adb1dc849bf2ac65a40c9ceb9.1732783000... Signed-off-by: Mark Brown broonie@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/spi/spi-mpc52xx.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-mpc52xx.c b/drivers/spi/spi-mpc52xx.c index 7b64e64c65cfe..2badf6535b306 100644 --- a/drivers/spi/spi-mpc52xx.c +++ b/drivers/spi/spi-mpc52xx.c @@ -519,6 +519,7 @@ static int mpc52xx_spi_remove(struct platform_device *op) struct mpc52xx_spi *ms = spi_master_get_devdata(master); int i;
+ cancel_work_sync(&ms->work); free_irq(ms->irq0, ms); free_irq(ms->irq1, ms);