diff options
| author | Yang Yingliang <[email protected]> | 2022-07-13 17:40:23 +0800 |
|---|---|---|
| committer | Mark Brown <[email protected]> | 2022-07-13 13:49:03 +0100 |
| commit | 7e9984d183bb1e99e766c5c2b950ff21f7f7b6c0 (patch) | |
| tree | ee47417ae89f3b8402d25a85a2d7a5491342749d /drivers/usb/cdns3/cdns3-imx.c | |
| parent | 43cc5a0afe4184a7fafe1eba32b5a11bb69c9ce0 (diff) | |
spi: tegra20-slink: fix UAF in tegra_slink_remove()
After calling spi_unregister_master(), the refcount of master will
be decrease to 0, and it will be freed in spi_controller_release(),
the device data also will be freed, so it will lead a UAF when using
'tspi'. To fix this, get the master before unregister and put it when
finish using it.
Fixes: 26c863418221 ("spi: tegra20-slink: Don't use resource-managed spi_register helper")
Signed-off-by: Yang Yingliang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
Diffstat (limited to 'drivers/usb/cdns3/cdns3-imx.c')
0 files changed, 0 insertions, 0 deletions