All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lukas Wunner <lukas@wunner.de>
To: Mark Brown <broonie@kernel.org>
Cc: linux-spi@vger.kernel.org, Chuanhong Guo <gch981213@gmail.com>
Subject: [PATCH 15/17] spi: ar934x: Don't leak SPI master in probe error path
Date: Mon, 7 Dec 2020 09:17:15 +0100	[thread overview]
Message-ID: <1d58367d74d55741e0c2730a51a2b65012c8ab33.1607286887.git.lukas@wunner.de> (raw)
In-Reply-To: <cover.1607286887.git.lukas@wunner.de>

If the call to devm_spi_register_controller() fails on probe of the
Qualcomm Atheros AR934x/QCA95xx SPI driver, the spi_controller struct is
erroneously not freed.  Fix by switching over to the new
devm_spi_alloc_master() helper.

Moreover, the controller's clock is enabled on probe but not disabled if
any of the subsequent probe steps fail.

Finally, there's an ordering issue in ar934x_spi_remove() wherein the
clock is disabled even though the controller is not yet unregistered.
It is unregistered after ar934x_spi_remove() by the devres framework.
As long as it is not unregistered, SPI transfers may still be ongoing
and disabling the clock may break them.  It is not possible to use
devm_spi_register_controller() in this case, so move to the non-devm
variant.

All of these bugs have existed since the driver was first introduced,
so it seems fair to fix them together in a single commit.

Fixes: 047980c582af ("spi: add driver for ar934x spi controller")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.7+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.7+
Cc: Chuanhong Guo <gch981213@gmail.com>
---
 drivers/spi/spi-ar934x.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/spi/spi-ar934x.c b/drivers/spi/spi-ar934x.c
index d08dec09d423..def32e0aaefe 100644
--- a/drivers/spi/spi-ar934x.c
+++ b/drivers/spi/spi-ar934x.c
@@ -176,10 +176,11 @@ static int ar934x_spi_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	ctlr = spi_alloc_master(&pdev->dev, sizeof(*sp));
+	ctlr = devm_spi_alloc_master(&pdev->dev, sizeof(*sp));
 	if (!ctlr) {
 		dev_info(&pdev->dev, "failed to allocate spi controller\n");
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto err_clk_disable;
 	}
 
 	/* disable flash mapping and expose spi controller registers */
@@ -202,7 +203,13 @@ static int ar934x_spi_probe(struct platform_device *pdev)
 	sp->clk_freq = clk_get_rate(clk);
 	sp->ctlr = ctlr;
 
-	return devm_spi_register_controller(&pdev->dev, ctlr);
+	ret = spi_register_controller(ctlr);
+	if (!ret)
+		return 0;
+
+err_clk_disable:
+	clk_disable_unprepare(clk);
+	return ret;
 }
 
 static int ar934x_spi_remove(struct platform_device *pdev)
@@ -213,6 +220,7 @@ static int ar934x_spi_remove(struct platform_device *pdev)
 	ctlr = dev_get_drvdata(&pdev->dev);
 	sp = spi_controller_get_devdata(ctlr);
 
+	spi_unregister_controller(ctlr);
 	clk_disable_unprepare(sp->clk);
 
 	return 0;
-- 
2.29.2


  parent reply	other threads:[~2020-12-07  8:45 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-07  8:17 [PATCH 00/17] SPI probe/remove sanitization for 5.11 Lukas Wunner
2020-12-07  8:17 ` [PATCH 01/17] spi: davinci: Fix use-after-free on unbind Lukas Wunner
2020-12-07  8:17 ` [PATCH 02/17] spi: spi-geni-qcom: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 03/17] spi: spi-qcom-qspi: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 04/17] spi: spi-sh: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 05/17] spi: pxa2xx: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 06/17] spi: rpc-if: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 07/17] spi: mxic: Don't leak SPI master in probe error path Lukas Wunner
2020-12-07  8:17 ` [PATCH 08/17] spi: spi-mtk-nor: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 09/17] spi: gpio: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 10/17] spi: rb4xx: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 11/17] spi: sc18is602: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 12/17] media: netup_unidvb: " Lukas Wunner
2020-12-07  8:17 ` [PATCH 13/17] spi: mt7621: Disable clock " Lukas Wunner
2020-12-07  8:17 ` [PATCH 14/17] spi: mt7621: Don't leak SPI master " Lukas Wunner
2020-12-07  8:17 ` Lukas Wunner [this message]
2020-12-07  8:17 ` [PATCH 16/17] spi: npcm-fiu: Disable clock " Lukas Wunner
2020-12-07  8:17 ` [PATCH 17/17] spi: atmel-quadspi: Fix use-after-free on unbind Lukas Wunner
2020-12-07 15:03   ` Tudor.Ambarus
2020-12-07 17:22 ` [PATCH 00/17] SPI probe/remove sanitization for 5.11 Mark Brown

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1d58367d74d55741e0c2730a51a2b65012c8ab33.1607286887.git.lukas@wunner.de \
    --to=lukas@wunner.de \
    --cc=broonie@kernel.org \
    --cc=gch981213@gmail.com \
    --cc=linux-spi@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.