tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

spi: mpc52xx: fix use-after-free on unbind

The state machine work is scheduled by the interrupt handler and
therefore needs to be cancelled after disabling interrupts to avoid a
potential use-after-free.

Fixes: 984836621aad ("spi: mpc52xx: Add cancel_work_sync before module remove")
Cc: stable@vger.kernel.org
Cc: Pei Xiao <xiaopei01@kylinos.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>

authored by

Johan Hovold and committed by
Mark Brown 706b3dc2 0f997fda

+2 -1
+2 -1
drivers/spi/spi-mpc52xx.c
··· 519 519 520 520 spi_unregister_controller(host); 521 521 522 - cancel_work_sync(&ms->work); 523 522 free_irq(ms->irq0, ms); 524 523 free_irq(ms->irq1, ms); 524 + 525 + cancel_work_sync(&ms->work); 525 526 526 527 for (i = 0; i < ms->gpio_cs_count; i++) 527 528 gpiod_put(ms->gpio_cs[i]);