-
Yang Yingliang authored
After calling spi_unregister_master(), the refcount of master will be decrease to 0, and it will be freed in spi_controller_release(), the device data also will be freed, so it will lead a UAF when using 'tspi'. To fix this, get the master before unregister and put it when finish using it. Fixes: 26c86341 ("spi: tegra20-slink: Don't use resource-managed spi_register helper") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20220713094024.1508869-1-yangyingliang@huawei.comSigned-off-by: Mark Brown <broonie@kernel.org>
7e9984d1