On Fri, Mar 12, 2021 at 11:34:46AM +0100, Alain Volmat wrote: > --- a/drivers/spi/spi-stm32.c > +++ b/drivers/spi/spi-stm32.c > @@ -1960,6 +1960,7 @@ static int stm32_spi_remove(struct platform_device > *pdev) > struct spi_master *master = platform_get_drvdata(pdev); > struct stm32_spi *spi = spi_master_get_devdata(master); > > + spi_unregister_master(master); > spi->cfg->disable(spi); > > if (master->dma_tx)
This introduces a use-after-free because spi_unregister_master() drops the last reference on the spi_master allocation (which includes the struct stm32_spi), causing it to be freed, yet the stm32_spi struct is accessed afterwards. You need to convert the driver to devm_spi_alloc_master() to fix the use-after-free. See commit 6cfd39e212de for an example. Thanks, Lukas
