Unverified Commit 706b3dc2 authored by Johan Hovold's avatar Johan Hovold Committed by Mark Brown
Browse files

spi: mpc52xx: fix use-after-free on unbind 



The state machine work is scheduled by the interrupt handler and
therefore needs to be cancelled after disabling interrupts to avoid a
potential use-after-free.

Fixes: 98483662 ("spi: mpc52xx: Add cancel_work_sync before module remove")
Cc: stable@vger.kernel.org
Cc: Pei Xiao <xiaopei01@kylinos.cn>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-5-johan@kernel.org


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent 0f997fda

drivers/spi/spi-mpc52xx.c

+2 −1
Original line number Diff line number Diff line
@@ -519,10 +519,11 @@ static void mpc52xx_spi_remove(struct platform_device *op) 


	spi_unregister_controller(host);



	cancel_work_sync(&ms->work);

	free_irq(ms->irq0, ms);

	free_irq(ms->irq1, ms);



	cancel_work_sync(&ms->work);



	for (i = 0; i < ms->gpio_cs_count; i++)

		gpiod_put(ms->gpio_cs[i]);