iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/spi
History
Yang Yingliang 415b4ce613 spi: tegra20-slink: fix UAF in tegra_slink_remove() 
[ Upstream commit 7e9984d183bb1e99e766c5c2b950ff21f7f7b6c0 ]

After calling spi_unregister_master(), the refcount of master will
be decrease to 0, and it will be freed in spi_controller_release(),
the device data also will be freed, so it will lead a UAF when using
'tspi'. To fix this, get the master before unregister and put it when
finish using it.

Fixes: 26c863418221 ("spi: tegra20-slink: Don't use resource-managed spi_register helper")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20220713094024.1508869-1-yangyingliang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-17 14:23:12 +02:00
..
atmel-quadspi.c
spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller
2022-04-27 14:39:02 +02:00
internals.h
…
Kconfig
spi: rockchip-sfc: add rockchip serial flash controller
2021-08-17 13:36:04 +01:00
Makefile
spi: rockchip-sfc: add rockchip serial flash controller
2021-08-17 13:36:04 +01:00
spi-altera-core.c
spi: altera: separate core code from platform code
2021-04-20 17:26:40 +01:00
spi-altera-dfl.c
spi: spi-altera-dfl: Fix an error handling path
2022-08-17 14:23:06 +02:00
spi-altera-platform.c
spi: altera: Change to dynamic allocation of spi id
2021-10-20 01:53:15 +01:00
spi-amd.c
spi: amd: Limit max transfer and message size
2022-07-21 21:24:16 +02:00
spi-ar934x.c
spi: ar934x: Don't leak SPI master in probe error path
2020-12-07 14:18:59 +00:00
spi-armada-3700.c
spi: change clk_disable_unprepare to clk_unprepare
2021-12-29 12:28:39 +01:00
spi-at91-usart.c
spi: spi-at91-usart: Remove unused OF table 'struct of_device_id'
2020-07-17 16:38:54 +01:00
spi-ath79.c
spi: ath79: set number of chipselect lines
2021-05-24 09:51:38 +01:00
spi-atmel.c
spi: atmel: Fix PDC transfer setup bug
2021-10-01 19:34:55 +01:00
spi-au1550.c
spi: spi-au1550: Fix various whitespace warnings
2021-01-22 16:26:21 +00:00
spi-axi-spi-engine.c
spi: spi-axi-spi-engine: remove usage of delay_usecs
2021-03-12 14:30:42 +00:00
spi-bcm63xx-hsspi.c
spi: bcm63xx-hsspi: fix pm_runtime
2021-03-10 12:25:12 +00:00
spi-bcm63xx.c
spi: bcm63xx-spi: don't check 'delay_usecs' field
2021-03-12 14:30:43 +00:00
spi-bcm2835.c
spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers
2022-07-29 17:25:24 +02:00
spi-bcm2835aux.c
spi: bcm2835aux: use 'unsigned int' instead of 'unsigned'
2021-08-03 18:27:25 +01:00
spi-bcm-qspi.c
spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op()
2022-04-13 20:59:19 +02:00
spi-bcm-qspi.h
…
spi-bitbang-txrx.h
…
spi-bitbang.c
spi: Cleanup on failure of initial setup
2021-06-01 14:03:12 +01:00
spi-brcmstb-qspi.c
…
spi-butterfly.c
spi: butterfly: Switch to use module_parport_driver()
2021-03-10 12:46:05 +00:00
spi-cadence-quadspi.c
spi: cadence-quadspi: fix Direct Access Mode disable for SoCFPGA
2022-06-09 10:22:53 +02:00
spi-cadence.c
spi: cadence: Correct initialisation of runtime PM again
2021-07-19 12:58:44 +01:00
spi-cavium-octeon.c
…
spi-cavium-thunderx.c
…
spi-cavium.c
…
spi-cavium.h
…
spi-clps711x.c
spi: clps711xx: remove redundant white-space
2021-02-04 18:45:59 +00:00
spi-coldfire-qspi.c
spi: coldfire-qspi: Use clk_disable_unprepare in the remove function
2021-08-19 18:20:10 +01:00
spi-davinci.c
spi: davinci: invoke chipselect callback
2021-08-24 20:53:24 +01:00
spi-dln2.c
spi: dln2: Fix reference leak to master
2021-04-09 13:43:57 +01:00
spi-dw-bt1.c
spi: dw: Avoid stack content exposure
2021-02-12 12:41:49 +00:00
spi-dw-core.c
spi: dw: Add support for 32-bits max xfer size
2020-12-09 12:14:22 +00:00
spi-dw-dma.c
spi: dw: Add generic DW SSI status-check method
2020-10-08 23:00:18 +01:00
spi-dw-mmio.c
spi: delete repeated words in comments
2021-05-10 13:07:52 +01:00
spi-dw-pci.c
spi: dw: Add DWC SSI capability
2020-10-08 23:00:06 +01:00
spi-dw.h
spi: dw: Add support for 32-bits max xfer size
2020-12-09 12:14:22 +00:00
spi-ep93xx.c
spi: spi-ep93xx: Prepare clock before using it
2021-08-03 18:27:24 +01:00
spi-falcon.c
spi: spi-falcon: remove check for 'delay_usecs'
2021-03-12 14:30:48 +00:00
spi-fsi.c
spi: fsi: Reduce max transfer size to 8 bytes
2021-07-19 16:56:14 +01:00
spi-fsl-cpm.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
spi-fsl-cpm.h
…
spi-fsl-dspi.c
spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
2021-08-10 13:22:19 +01:00
spi-fsl-espi.c
spi: fsl-espi: remove usage of 'delay_usecs' field
2021-03-12 14:30:49 +00:00
spi-fsl-lib.c
…
spi-fsl-lib.h
…
spi-fsl-lpspi.c
spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()
2021-04-09 13:43:59 +01:00
spi-fsl-qspi.c
spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()
2022-06-09 10:22:55 +02:00
spi-fsl-spi.c
spi: Cleanup on failure of initial setup
2021-06-01 14:03:12 +01:00
spi-fsl-spi.h
…
spi-geni-qcom.c
spi: spi-geni-qcom: Remove confusing comment about setting the watermark
2021-07-14 16:37:58 +01:00
spi-gpio.c
spi: gpio: Don't leak SPI master in probe error path
2020-12-07 14:18:54 +00:00
spi-hisi-kunpeng.c
spi: hisi-kunpeng: Fix the debugfs directory name incorrect
2022-01-27 11:03:12 +01:00
spi-hisi-sfc-v3xx.c
spi: hisi-sfc-v3xx: drop unnecessary ACPI_PTR and related ifendif protection
2021-04-12 17:07:38 +01:00
spi-img-spfi.c
spi: img-spfi: Fix pm_runtime_get_sync() error checking
2022-06-09 10:22:48 +02:00
spi-imx.c
ARM: SoC drivers for 5.15
2021-09-01 15:25:28 -07:00
spi-iproc-qspi.c
…
spi-jcore.c
spi: jcore: Fix trailing statements should be on next line
2021-03-24 19:51:09 +00:00
spi-lantiq-ssc.c
spi: lantiq: remove redundant irqsave and irqrestore in hardIRQ
2020-09-17 19:56:02 +01:00
spi-lm70llp.c
spi: lm70llp: add parenthesis for sizeof
2021-05-20 18:00:34 +01:00
spi-loopback-test.c
spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf'
2021-05-10 13:07:53 +01:00
spi-lp8841-rtc.c
…
spi-mem.c
spi: spi-mem: fix doc warning in spi-mem.c
2021-06-14 15:05:00 +01:00
spi-meson-spicc.c
spi: meson-spicc: add IRQ check in meson_spicc_probe
2022-02-08 18:34:08 +01:00
spi-meson-spifc.c
spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe
2022-01-27 11:03:59 +01:00
spi-mpc52xx-psc.c
spi: mpc52xx-psc: add parenthesis for sizeof
2021-05-20 18:00:37 +01:00
spi-mpc52xx.c
spi: mpc52xx: add parenthesis for sizeof
2021-05-20 18:00:36 +01:00
spi-mpc512x-psc.c
spi: mpc512x-psc: add parenthesis for sizeof
2021-05-20 18:00:35 +01:00
spi-mt65xx.c
spi: mediatek: support tick_delay without enhance_timing
2022-04-08 14:24:15 +02:00
spi-mt7621.c
spi: mt7621: Don't leak SPI master in probe error path
2020-12-07 14:18:59 +00:00
spi-mtk-nor.c
spi: spi-mtk-nor: initialize spi controller after resume
2022-04-27 14:38:52 +02:00
spi-mux.c
spi-mux: Fix false-positive lockdep splats
2021-10-14 13:32:19 +01:00
spi-mxic.c
spi: mxic: Fix the transmit path
2022-04-08 14:22:53 +02:00
spi-mxs.c
spi: mxs: fix reference leak in mxs_spi_probe
2020-11-18 18:00:26 +00:00
spi-npcm-fiu.c
spi: npcm-fiu: Disable clock in probe error path
2020-12-07 14:19:00 +00:00
spi-npcm-pspi.c
spi: npcm-pspi: Use SPI_MODE_X_MASK
2021-05-11 15:42:48 +01:00
spi-nxp-fspi.c
spi: spi-nxp-fspi: don't depend on a specific node name erratum workaround
2021-10-02 01:31:49 +01:00
spi-oc-tiny.c
spi: oc-tiny: Use SPI_MODE_X_MASK
2021-05-11 15:42:49 +01:00
spi-omap2-mcspi.c
Merge branch 'for-5.13' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into spi-5.14
2021-06-01 18:33:33 +01:00
spi-omap-100k.c
spi: fix some invalid char occurrences
2021-05-20 17:58:33 +01:00
spi-omap-uwire.c
Merge branch 'for-5.13' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into spi-5.14
2021-06-01 18:33:33 +01:00
spi-orion.c
spi: orion: Prevent incorrect chip select behaviour
2021-08-16 13:28:14 +01:00
spi-pic32-sqi.c
…
spi-pic32.c
spi: spi-pic32: Fix issue with uninitialized dma_slave_config
2021-08-10 13:22:20 +01:00
spi-pl022.c
spi: spl022: fix Microwire full duplex mode
2021-10-26 11:53:57 +01:00
spi-ppc4xx.c
spi: ppc4xx: add parenthesis for sizeof
2021-05-20 18:00:40 +01:00
spi-pxa2xx-dma.c
spi: pxa2xx: Fix style of and typos in the comments and messages
2021-05-18 14:05:35 +01:00
spi-pxa2xx-pci.c
spi: pxa2xx-pci: Balance reference count for PCI DMA device
2022-04-08 14:23:07 +02:00
spi-pxa2xx.c
spi: pxa2xx: Adapt reset_sccr1() to the case when no message available
2021-07-22 12:41:19 +01:00
spi-pxa2xx.h
spi: pxa2xx: Fix style of and typos in the comments and messages
2021-05-18 14:05:35 +01:00
spi-qcom-qspi.c
spi: spi-qcom-qspi: Convert to use resource-managed OPP API
2021-03-16 10:14:11 +05:30
spi-qup.c
spi: qup: fix PM reference leak in spi_qup_remove()
2021-04-09 13:44:03 +01:00
spi-rb4xx.c
spi: rb4xx: Don't leak SPI master in probe error path
2020-12-07 14:18:55 +00:00
spi-realtek-rtl.c
spi: realtek-rtl: Add support for Realtek RTL838x/RTL839x SPI controllers
2021-02-04 18:45:57 +00:00
spi-rockchip-sfc.c
spi: rockchip-sfc: Fix assigned but never used return error codes
2021-08-23 16:41:08 +01:00
spi-rockchip.c
spi: rockchip: fix missing error on unsupported SPI_CS_HIGH
2022-06-09 10:22:50 +02:00
spi-rpc-if.c
spi: spi-rpc-if: Check return value of rpcif_sw_init()
2021-11-18 19:16:42 +01:00
spi-rspi.c
spi: spi-rspi: Fix PIO fallback on RZ platforms
2022-08-17 14:23:05 +02:00
spi-s3c24xx-regs.h
ARM: s3c24xx: move regs-spi.h into spi driver
2020-08-19 21:40:14 +02:00
spi-s3c24xx.c
ARM: SoC platform updates
2020-10-24 10:33:08 -07:00
spi-s3c64xx.c
spi: s3c64xx: constify driver/match data
2021-04-15 16:07:58 +01:00
spi-sc18is602.c
spi: sc18is602: implement .max_{transfer,message}_size() for the controller
2021-05-21 13:13:33 +01:00
spi-sh-hspi.c
…
spi-sh-msiof.c
spi: spi-sh-msiof: : use proper DMAENGINE API for termination
2021-06-23 16:33:53 +01:00
spi-sh-sci.c
…
spi-sh.c
spi: spi-sh: replace 'delay_usecs' with 'delay.value' in pr_debug
2021-03-12 14:30:45 +00:00
spi-sifive.c
…
spi-slave-mt27xx.c
spi: mediatek: add mt8195 spi slave support
2021-03-23 17:19:45 +00:00
spi-slave-system-control.c
…
spi-slave-time.c
…
spi-sprd-adi.c
spi: sprd: Add ADI r3 support
2021-08-26 12:09:38 +01:00
spi-sprd.c
spi: sprd: Add missing MODULE_DEVICE_TABLE
2021-05-12 13:01:43 +01:00
spi-st-ssc4.c
spi: st-ssc4: Fix unbalanced pm_runtime_disable() in probe error path
2020-11-12 15:16:35 +00:00
spi-stm32-qspi.c
spi: stm32-qspi: Fix wait_cmd timeout in APM mode
2022-06-09 10:22:36 +02:00
spi-stm32.c
spi: stm32: fix excluded_middle.cocci warnings
2021-08-20 13:07:27 +01:00
spi-sun4i.c
spi: sun4i: update max transfer size reported
2020-07-27 14:55:21 +01:00
spi-sun6i.c
spi: spi-sun6i: Fix chipselect/clock bug
2021-06-23 11:48:36 +01:00
spi-synquacer.c
spi: synquacer: Add missing clk_disable_unprepare()
2022-08-17 14:23:03 +02:00
spi-tegra20-sflash.c
spi: spi-tegra20-flash: don't check 'delay_usecs' field for spi transfer
2021-03-12 14:30:46 +00:00
spi-tegra20-slink.c
spi: tegra20-slink: fix UAF in tegra_slink_remove()
2022-08-17 14:23:12 +02:00
spi-tegra114.c
spi: tegra114: Add missing IRQ check in tegra_spi_probe
2022-04-08 14:23:05 +02:00
spi-tegra210-quad.c
spi: tegra210-quad: Fix missin IRQ check in tegra_qspi_probe
2022-04-08 14:23:06 +02:00
spi-test.h
…
spi-ti-qspi.c
spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout
2022-06-09 10:22:46 +02:00
spi-tle62x0.c
…
spi-topcliff-pch.c
spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages()
2021-05-10 13:17:16 +01:00
spi-uniphier.c
spi: uniphier: fix reference count leak in uniphier_spi_probe()
2022-02-08 18:34:08 +01:00
spi-xcomm.c
…
spi-xilinx.c
spi: xilinx: Fix info message during probe
2020-09-17 19:56:01 +01:00
spi-xlp.c
…
spi-xtensa-xtfpga.c
…
spi-zynq-qspi.c
spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()
2022-03-02 11:48:01 +01:00
spi-zynqmp-gqspi.c
spi: spi-zynqmp-gqspi: Handle error for dma_set_mask
2022-04-08 14:23:07 +02:00
spi.c
spi: Fix simplification of devm_spi_register_controller
2022-08-17 14:23:12 +02:00
spidev.c
spi: spidev: Add SPI ID table
2021-09-27 12:59:15 +01:00