tree eb27f5bb3c2d4720aa8832d9c1886eea08a21ed5
parent 35700e221b18fa53401e5f315be90af9e0bbcdca
author Zhenzhong Duan <zhenzhong.duan@gmail.com> 1592450484 +0800
committer Mark Brown <broonie@kernel.org> 1592498819 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAl7rmoMTHGJyb29uaWVA
 a2VybmVsLm9yZwAKCRAk1otyXVSH0OQyB/0fU1cZYVYQZg99DTyXZ0wUhROWyer+
 YNQ2Xuvo2k/VF68tldPrazeFqqrTAxmWLkYvEuzPxYdW0WZRqxe9jsVpUxrrntkm
 ZQvgFuK1WXQ6JqJ+9SqCVJe0qfpQfacr8C089Mtmfwu4Kexj/JifGQh7UFiWthSF
 W3mqGB5rtX7YcbxTVtnZerRp37OR3UtRxBzRt9x34V62zKd4Uo4sfjFdg3JBFidX
 xYtZUQ52LOHLbBlTgQFLwPo4BUB2y1WGLkW85HrJdcVKxx6wiU04Vr8ojv9P04nQ
 SEGazbaqONt3xwsz5sp4QBP4WxVxErTZKnGwtLykA2+fuNYarjxqrPtv
 =94lZ
 -----END PGP SIGNATURE-----

spi: spidev: fix a race between spidev_release and spidev_remove

Imagine below scene, spidev is referenced after it's freed.

spidev_release()                spidev_remove()
...
                                spin_lock_irq(&spidev->spi_lock);
                                    spidev->spi = NULL;
                                spin_unlock_irq(&spidev->spi_lock);
mutex_lock(&device_list_lock);
dofree = (spidev->spi == NULL);
if (dofree)
    kfree(spidev);
mutex_unlock(&device_list_lock);
                                mutex_lock(&device_list_lock);
                                list_del(&spidev->device_entry);
                                device_destroy(spidev_class, spidev->devt);
                                clear_bit(MINOR(spidev->devt), minors);
                                if (spidev->users == 0)
                                    kfree(spidev);
                                mutex_unlock(&device_list_lock);

Fix it by resetting spidev->spi in device_list_lock's protection.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
Link: https://lore.kernel.org/r/20200618032125.4650-1-zhenzhong.duan@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>