spi: fsl-dspi: fix use-after-free in remove path

spi_unregister_controller() not only unregisters the controller, but
also frees the controller. This will free the driver data with it, so
we must not access it later dspi_remove().

Solve this by allocating the driver data separately from the SPI
controller.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Link: https://lore.kernel.org/r/20200923131026.20707-1-s.hauer@pengutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 283f246..127323a 100644 (file)
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -1273,11 +1273,14 @@ static int dspi_probe(struct platform_device *pdev)
        void __iomem *base;
        bool big_endian;
 
-       ctlr = spi_alloc_master(&pdev->dev, sizeof(struct fsl_dspi));
+       dspi = devm_kzalloc(&pdev->dev, sizeof(*dspi), GFP_KERNEL);
+       if (!dspi)
+               return -ENOMEM;
+
+       ctlr = spi_alloc_master(&pdev->dev, 0);
        if (!ctlr)
                return -ENOMEM;
 
-       dspi = spi_controller_get_devdata(ctlr);
        dspi->pdev = pdev;
        dspi->ctlr = ctlr;
 
@@ -1414,7 +1417,7 @@ poll_mode:
        if (dspi->devtype_data->trans_mode != DSPI_DMA_MODE)
                ctlr->ptp_sts_supported = true;
 
-       platform_set_drvdata(pdev, ctlr);
+       platform_set_drvdata(pdev, dspi);
 
        ret = spi_register_controller(ctlr);
        if (ret != 0) {
@@ -1437,8 +1440,7 @@ out_ctlr_put:
 
 static int dspi_remove(struct platform_device *pdev)
 {
-       struct spi_controller *ctlr = platform_get_drvdata(pdev);
-       struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr);
+       struct fsl_dspi *dspi = platform_get_drvdata(pdev);
 
        /* Disconnect from the SPI framework */
        spi_unregister_controller(dspi->ctlr);