From: Patrice CHOTARD <patrice.chotard@foss.st.com> To: Lukas Wunner <lukas@wunner.de> Cc: Mark Brown <broonie@kernel.org>, Alexandre Torgue <alexandre.torgue@foss.st.com>, <linux-spi@vger.kernel.org>, <linux-stm32@st-md-mailman.stormreply.com>, <linux-arm-kernel@lists.infradead.org>, <linux-kernel@vger.kernel.org>, <christophe.kerello@foss.st.com> Subject: Re: spi: stm32-qspi: Update spi registering Date: Wed, 12 Jan 2022 14:54:09 +0100 [thread overview] Message-ID: <ba5de6f6-a4f0-4974-cc68-abcb62ebf96e@foss.st.com> (raw) In-Reply-To: <20220108194819.GA5467@wunner.de> Hi Lukas On 1/8/22 8:48 PM, Lukas Wunner wrote: > On Thu, Jan 06, 2022 at 02:20:52PM +0100, patrice.chotard@foss.st.com wrote: >> --- a/drivers/spi/spi-stm32-qspi.c >> +++ b/drivers/spi/spi-stm32-qspi.c >> @@ -784,7 +784,7 @@ static int stm32_qspi_probe(struct platform_device *pdev) >> pm_runtime_enable(dev); >> pm_runtime_get_noresume(dev); >> >> - ret = devm_spi_register_master(dev, ctrl); >> + ret = spi_register_master(ctrl); >> if (ret) >> goto err_pm_runtime_free; >> >> @@ -817,6 +817,7 @@ static int stm32_qspi_remove(struct platform_device *pdev) >> struct stm32_qspi *qspi = platform_get_drvdata(pdev); >> >> pm_runtime_get_sync(qspi->dev); >> + spi_unregister_master(qspi->ctrl); >> /* disable qspi */ >> writel_relaxed(0, qspi->io_base + QSPI_CR); >> stm32_qspi_dma_free(qspi); > > NAK, this introduces a use-after-free because the "qspi" allocation > is freed by spi_unregister_master(), yet is subsequently accessed. > > You need to convert the driver to devm_spi_alloc_master() to avoid that. > Do it in the same patch to ease backporting. Ok i see, spi_unregister_controller() is releasing the controller if it wasn't previously devm allocated. I will make usage of devm_spi_alloc_master as you suggested. > > Please add a stable designation and a Fixes: tag. Chances are the patch > needs to be backported all the way back to the release when the driver > was first introduced. > > Thanks, > > Lukas > Thanks Patrice
WARNING: multiple messages have this Message-ID (diff)
From: Patrice CHOTARD <patrice.chotard@foss.st.com> To: Lukas Wunner <lukas@wunner.de> Cc: Mark Brown <broonie@kernel.org>, Alexandre Torgue <alexandre.torgue@foss.st.com>, <linux-spi@vger.kernel.org>, <linux-stm32@st-md-mailman.stormreply.com>, <linux-arm-kernel@lists.infradead.org>, <linux-kernel@vger.kernel.org>, <christophe.kerello@foss.st.com> Subject: Re: spi: stm32-qspi: Update spi registering Date: Wed, 12 Jan 2022 14:54:09 +0100 [thread overview] Message-ID: <ba5de6f6-a4f0-4974-cc68-abcb62ebf96e@foss.st.com> (raw) In-Reply-To: <20220108194819.GA5467@wunner.de> Hi Lukas On 1/8/22 8:48 PM, Lukas Wunner wrote: > On Thu, Jan 06, 2022 at 02:20:52PM +0100, patrice.chotard@foss.st.com wrote: >> --- a/drivers/spi/spi-stm32-qspi.c >> +++ b/drivers/spi/spi-stm32-qspi.c >> @@ -784,7 +784,7 @@ static int stm32_qspi_probe(struct platform_device *pdev) >> pm_runtime_enable(dev); >> pm_runtime_get_noresume(dev); >> >> - ret = devm_spi_register_master(dev, ctrl); >> + ret = spi_register_master(ctrl); >> if (ret) >> goto err_pm_runtime_free; >> >> @@ -817,6 +817,7 @@ static int stm32_qspi_remove(struct platform_device *pdev) >> struct stm32_qspi *qspi = platform_get_drvdata(pdev); >> >> pm_runtime_get_sync(qspi->dev); >> + spi_unregister_master(qspi->ctrl); >> /* disable qspi */ >> writel_relaxed(0, qspi->io_base + QSPI_CR); >> stm32_qspi_dma_free(qspi); > > NAK, this introduces a use-after-free because the "qspi" allocation > is freed by spi_unregister_master(), yet is subsequently accessed. > > You need to convert the driver to devm_spi_alloc_master() to avoid that. > Do it in the same patch to ease backporting. Ok i see, spi_unregister_controller() is releasing the controller if it wasn't previously devm allocated. I will make usage of devm_spi_alloc_master as you suggested. > > Please add a stable designation and a Fixes: tag. Chances are the patch > needs to be backported all the way back to the release when the driver > was first introduced. > > Thanks, > > Lukas > Thanks Patrice _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2022-01-12 13:54 UTC|newest] Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-01-06 13:20 spi: stm32-qspi: Update spi registering patrice.chotard 2022-01-06 13:20 ` patrice.chotard 2022-01-06 13:51 ` Mark Brown 2022-01-06 13:51 ` Mark Brown 2022-01-12 13:18 ` Patrice CHOTARD 2022-01-12 13:18 ` Patrice CHOTARD 2022-01-08 19:48 ` Lukas Wunner 2022-01-12 13:54 ` Patrice CHOTARD [this message] 2022-01-12 13:54 ` Patrice CHOTARD
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=ba5de6f6-a4f0-4974-cc68-abcb62ebf96e@foss.st.com \ --to=patrice.chotard@foss.st.com \ --cc=alexandre.torgue@foss.st.com \ --cc=broonie@kernel.org \ --cc=christophe.kerello@foss.st.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-spi@vger.kernel.org \ --cc=linux-stm32@st-md-mailman.stormreply.com \ --cc=lukas@wunner.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.