Unverified Commit e957c964 authored by David Lechner's avatar David Lechner Committed by Mark Brown
Browse files

spi: offload: fix use after free 



Fix a use after free bug in devm_spi_offload_get() where a pointer
was dereferenced after being freed. Instead, add a new local variable
to avoid needing to use the resource pointer to access the offload
pointer.

Reported-by: default avatarkernel test robot <lkp@intel.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202502112344.7ggtFzyn-lkp@intel.com/


Fixes: 5a19e198 ("spi: axi-spi-engine: implement offload support")
Signed-off-by: default avatarDavid Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250212-spi-offload-fixes-v1-2-e192c69e3bb3@baylibre.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent d795a052

drivers/spi/spi-offload.c

+8 −5
Original line number Diff line number Diff line
@@ -108,6 +108,7 @@ struct spi_offload *devm_spi_offload_get(struct device *dev, 
					 const struct spi_offload_config *config)

{

	struct spi_controller_and_offload *resource;

	struct spi_offload *offload;

	int ret;



	if (!spi || !config)
@@ -120,18 +121,20 @@ struct spi_offload *devm_spi_offload_get(struct device *dev, 
	if (!resource)

		return ERR_PTR(-ENOMEM);



	resource->controller = spi->controller;

	resource->offload = spi->controller->get_offload(spi, config);

	if (IS_ERR(resource->offload)) {

	offload = spi->controller->get_offload(spi, config);

	if (IS_ERR(offload)) {

		kfree(resource);

		return resource->offload;

		return offload;

	}



	resource->controller = spi->controller;

	resource->offload = offload;



	ret = devm_add_action_or_reset(dev, spi_offload_put, resource);

	if (ret)

		return ERR_PTR(ret);



	return resource->offload;

	return offload;

}

EXPORT_SYMBOL_GPL(devm_spi_offload_get);